v1.2.0 - live sync across your team

Shared two-factor auth, without the chaos.

2fashare is a secure home for your team's 2FA codes. Role-based access, real-time rotation, audit logs, and one-click revoke - so you can stop screenshotting codes in Slack.

RLS-scoped secrets30s rotationRole-based access
live · 2fashare
synced
github · deploy-bot
048 333
23
stripe · billing
793 699
23
aws · prod-root
816 435
23
secrets encrypted · rls scopedrotates in 23s

Works alongside the tools your team already uses

githubstripeawsvercellinearsupabase
// features

Everything you need to share 2FA without the footguns.

Built for teams that need real security without the process tax.

Role-based access

Admin, Manager, User - assign precise access so the right people get the right codes.

Live code rotation

TOTP codes rotate every 30s in real time across every device, no refresh needed.

Secure share links

Share a single code or a whole group with time-boxed, revokable links.

Row-level security

Postgres RLS keeps secrets scoped. Each user only ever sees what they should.

Audit logs

Every code view, share, and rotation is logged and searchable.

Works everywhere

Web-first, keyboard-friendly, mobile-ready. Cmd+K to jump anywhere.

// how it works

Three steps. No spreadsheets.

  1. 01

    Create a group

    Bundle related 2FA codes - one per vendor, product, or team - into a single shared space everyone invited can unlock together.

  2. 02

    Add 2FA codes

    Paste the secret or scan the QR - we'll rotate the codes for you every 30 seconds.

  3. 03

    Invite your team

    Drop teammates into the group by role. Everyone sees every code inside - onboard and offboard in one click.

// what's a group?

Think of a group as a shared vault.

A group is a shared space for 2FA codes that belong together - usually one per vendor, product, or team. Everyone invited can see every code inside, so there's no more "hey, what's the code?" in DMs.

Groups are the unit of access. Permissions, audit logs, and share links all live at the group level, which makes onboarding, offboarding, and rotating secrets dramatically simpler.

  • One home for related codes

    Keep GitHub, AWS, Stripe, and vendor logins in their own focused spaces instead of one giant pile.

  • Shared access, scoped right

    Add teammates once - they get every code inside, without DMs, screenshots, or secret-sharing in Slack.

  • Onboard and offboard instantly

    New hire? Drop them in. Someone leaves? Remove them and they lose access to every code in the group at once.

// security

Built with defense in depth.

Postgres RLS, encrypted secrets at rest, scoped Supabase policies, audited every step. We make the secure path the default path.

  • Row-level security per group
  • Secrets encrypted at rest
  • Short-lived share links
  • One-click revoke
  • Detailed audit trail
  • Works with SSO-auth'd email
rls.sqlsupabase
create policy "members read group codes"
  on group_codes for select
  using (
    exists (
      select 1 from user_groups ug
      where ug.group_id = group_codes.group_id
        and ug.user_id  = auth.uid()
    )
  );
// what is 2fashare

What is 2fashare?

2fashare is a shared two-factor authentication platform that gives teams one secure home for the TOTP codes behind their shared accounts. Instead of screenshotting one-time codes into Slack or passing an authenticator phone around the office, your team stores each secret once and the right people generate live, rotating codes in their browser.

Access is scoped by group and by role - Admin, Manager, or User - so each teammate only ever sees the codes they have been granted. Every view, copy, share, and rotation lands in a searchable audit log, and time-boxed share links extend a single code or a whole group to someone outside the workspace without exposing the underlying secret.

Secrets are encrypted at rest and protected by Postgres row-level security. When someone leaves, removing them once revokes everything they could reach - no secret rotation required. 2fashare is free to get started.

// faq

Common questions

What's a group, exactly?+

A group is a shared container for related 2FA codes - one per vendor, product, or team works well. Add codes once, invite members once, and everyone inside sees every code. Remove someone from the group and they instantly lose access to all of it, with no rotating of secrets required.

How are secrets stored?+

Secrets are encrypted at rest in Supabase, protected by row-level security, and never leave an authenticated session.

Does this replace my authenticator app?+

For shared team accounts, yes. For personal accounts we still recommend a hardware key or a personal authenticator.

Can I share codes outside the team?+

Yes - admins can mint share links with an expiry. Links can be revoked instantly.

Is there an audit log?+

Every action - view, copy, share, rotation - is logged and searchable by admins.

Stop screenshotting codes.Start sharing them safely.

2fashare takes ten minutes to set up and saves you every "hey, what's the code?" forever.