0fa.site
Home / Legal / Terms of Service
Official Agreement

Terms of Service

Please read these Terms of Service carefully before utilizing 0fa.site. By accessing or using our client-side authenticator, ephemeral link generation, or verification utilities, you agree to be bound by these Terms.

Effective Date: October 24, 2026 • Version 2.4 • Applicable Globally

1. Acceptance of Terms

By accessing or using the website located at https://0fa.site (the "Service", "0fa.site", "we", "us", or "our"), you confirm that you are at least 18 years of age (or have reached the age of majority in your jurisdiction) and possess the legal capacity to enter into this agreement. If you do not agree with any part of these Terms, you must immediately discontinue your use of the Service.

💡

Direct Client-Side Architecture

0fa.site operates strictly within your web browser using standard W3C Web Cryptography APIs. We do not store, view, or retain your raw two-factor authentication (2FA) private secrets on central backend databases.

2. Description of Service

0fa.site is a specialized, privacy-engineered web tool designed to generate standardized Time-Based One-Time Passwords (TOTP) adhering to IETF RFC 6238 and HMAC algorithms (RFC 4226).

The Service provides the following primary capabilities:

  • Single & Bulk 2FA Generation: Real-time generation of 6-digit or 8-digit verification codes using client-side Web Crypto algorithms.
  • Ephemeral Customer Delivery Portals: Generating secure, time-limited, view-capped verification links (e.g. for e-commerce and marketplace customer order fulfillment).
  • Anti-Ban Link Masking: Neutral delivery formatting to prevent automated domain filtering by marketplace messaging systems.
  • Admin Studio Controller: Optional token-gated management interface for merchants controlling link duration and revocation.

3. Zero-Knowledge Cryptography Guarantee

Our core architecture is built upon the principle of Zero-Knowledge:

  • When you open a link formatted with a URL hash (e.g., https://0fa.site/#t=SECRET), the portion following the # character is never transmitted to any web server or network edge, pursuant to IETF RFC 3986 specifications.
  • All cryptographic key derivations, SHA calculations, and code counters are executed locally by your device's browser engine using crypto.subtle.sign.
  • We do not record, log, or serialize your secret keys in web server access logs.

4. Ephemeral Delivery Links & Burn-After-Read Policy

For ephemeral links generated via our Edge Worker KV infrastructure:

  1. Time-to-Live (TTL): Links automatically expire and are purged from edge cache upon reaching their configured lifespan (default: 24 to 72 hours).
  2. Burn-After-Read Limits: Links configured with maximum view limits (e.g., single-use) are irrevocably incinerated once the threshold is reached.
  3. Merchant Revocation: Authorized merchants reserve the right to revoke active delivery links at any time prior to buyer access.

5. Acceptable Use Policy

You agree not to use the Service for any unlawful or unauthorized purposes, including but not limited to:

  • Distributing phishing links, malware, ransomware, or deceptive credential-harvesting mechanisms.
  • Attempting to bypass, reverse engineer, or defeat edge security controls, rate limiters, or authentication gates.
  • Fulfilling orders for stolen, compromised, or illegally obtained digital merchandise.
  • Conducting automated denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks against 0fa.site infrastructure.
  • Violating intellectual property rights, trade secrets, or privacy rights of any third party.

We reserve the right to immediately terminate access and revoke links associated with any user violating this policy without notice.

6. Disclaimers of Warranties

THE SERVICE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, OR SYSTEM AVAILABILITY.

0FA.SITE DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, SECURE FROM MALICIOUS ACTS, OR THAT TOTP TIMESTAMPS WILL REMAIN PERFECTLY SYNCHRONIZED ON DEVICES WITH MISCONFIGURED HARDWARE CLOCKS.

7. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL 0FA.SITE, ITS DEVELOPERS, AFFILIATES, OR INFRASTRUCTURE PROVIDERS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, DATA, OR ACCOUNT ACCESS, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OR INABILITY TO USE THE SERVICE.

8. Indemnification

You agree to defend, indemnify, and hold harmless 0fa.site and its operators from and against any claims, liabilities, damages, losses, and expenses (including legal fees) arising out of or in any way connected with your violation of these Terms or your misuse of the Service.

9. Service Modifications & Termination

We reserve the right to modify, suspend, or discontinue any aspect of the Service at any time with or without notice. We may update these Terms periodically, and continued use of 0fa.site constitutes acceptance of updated terms.

10. Governing Law & Severability

These Terms shall be governed by and construed in accordance with the laws of international e-commerce standards without regard to conflict of law principles. If any provision of these Terms is deemed invalid or unenforceable, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force.

11. Contact & Legal Inquiries

For legal notices, compliance questions, or terms inquiries, please contact our legal counsel: