Skip to content

Display Interface language

Loading configuration…

Master key is missing

Configure MASTER_KEY as a Base64-encoded 32-byte value before continuing.

npx wrangler secret put MASTER_KEY

First-time setup

Create an admin password of at least 12 characters. TOTP secrets are encrypted in D1.

Setup token

Enter the SETUP_TOKEN secret you configured in Cloudflare.

Admin password

Confirm password

Admin access

Admin password

Code configuration

Display access

Search code configurations

Per page

Select filtered results

Loading configuration…

No code configurations match your search.

No codes have been configured.

Go to page

Add code

Paste an otpauth URI or Base32 secret, or read a QR code.

otpauth URI or secret

Read QR image

QR images are decoded on this device and are never uploaded.

Account name (optional when present in URI)

Service (optional)

Advanced parameters

Algorithm

Digits

Period (seconds)

Add to the display after saving

Generate test codes

Generate independent secure random secrets for extreme layout testing, up to 200 at once.

Name prefix

Service (optional)

Quantity

Digits

Period (seconds)

Add all to the display

These random secrets are for layout testing. They cannot sign in unless the same secrets are configured in the target services.

Import code batch

Upload an exported JSON file, or paste one otpauth URI/Base32 secret per line, up to 500 items.

JSON or text file

The file is read only in your browser and encrypted through the authenticated API.

Or paste content

Add every imported item to the display

Choose a file or paste content to see a preview.

Export selected codes?

The export contains plaintext secrets that can generate valid codes. Store it securely and delete it safely when finished.

Scan QR code

Place the entire QR code inside the frame. Video stays on this device.

Delete this code?

Change admin password

Current password

New password

Confirm new password

Set display access

This only affects the display. Management and configuration APIs always require sign-in.

Display access Password required Only a signed-in admin session can view codes. Public display Anyone who can reach the display URL can view it directly.

Public display exposes account names and live verification codes. Use it only on a controlled screen or trusted network.

Discard unsaved changes?

Your current input has not been saved.