24/7 Global Infrastructure

Contact & Help Center

Have questions about your two-factor codes, customer delivery links, or merchant API integrations? Our support team and knowledge base are here to assist you.

๐Ÿ’ฌ

Customer Support

Questions regarding order delivery, TOTP synchronization, or using the authenticator.

Email Support โ†—
๐Ÿ›ก๏ธ

Security & Disclosure

Responsible vulnerability disclosures, cryptographic queries, or audit inquiries.

Security Team โ†—
โš–๏ธ

Abuse & DMCA

Report suspicious, phishing, or unauthorized links for immediate edge revocation.

Report Abuse โ†—
โšก

Merchant & API Sales

Integrate 0fa.site automated delivery into your marketplace storefront or shop.

Merchant Desk โ†—

Frequently Asked Questions (FAQ)

Click on any question below to view detailed technical explanations and troubleshooting steps:

0fa.site is a client-side Time-Based One-Time Password (TOTP) generator adhering to IETF RFC 6238. It takes your Base32 secret key, computes the current 30-second time interval counter, and calculates a dynamic HMAC-SHA1 signature using your web browser's native Web Cryptography API. All operations run 100% locally on your computer or phone.
No, never. Standard delivery links use the URL fragment (#t=SECRET). Under internet standards (RFC 3986), the fragment identifier is strictly withheld by your web browser and is never transmitted in HTTP request headers. Cloudflare edge servers and intermediate proxies never see or log your secret keys.
TOTP verification relies strictly on synchronized time between your device and the service provider (e.g. Google, OpenAI, Microsoft). If your phone or computer clock is offset by more than 30 to 60 seconds, the generated code will be out of step. To resolve this, ensure your device's "Date & Time" settings are set to "Set time automatically" (Network Time Protocol / NTP).
Links generated with view limits (e.g. single-view) are managed by our Cloudflare Worker KV storage. When the recipient views the code for the first time, an atomic decrement triggers an immediate cryptographic deletion (KV.delete). Any subsequent attempt to open the link will display an "Expired or Burned" notice, ensuring credentials cannot be intercepted later.
Yes! Thousands of digital goods sellers on GGsel, Plati, and Digiseller utilize our automated delivery link format. Sellers can format URLs with https://0fa.site/#t=SECRET or use our Edge API to auto-dispatch clean, branded customer delivery messages containing live 2FA countdowns and auto-copy buttons.
If you encounter an unauthorized, malicious, or deceptive link hosted via our ephemeral service, please forward the exact URL immediately to abuse@0fa.site. Our security operations team reviews and incinerates flagged links within hours.