About Crew2FA

A free, multi-tenant TOTP sharing service funded by advertising.

Crew2FA was created by an independent software developer to solve the problem of securely sharing TOTP codes across small teams and organizations without sharing devices, passwords, or authenticator apps. The service is free to use, with operating costs covered by advertising on non-critical pages.

Why Crew2FA?

Many organizations eventually encounter services that require a single shared TOTP authenticator. The common solutions—sharing phones, sharing passwords, sending screenshots, or keeping authenticator apps on one person's device—create operational and security problems.

Crew2FA was built to provide a centralized way to securely store and share TOTP secrets while preserving individual user accounts, role-based access, audit logging, and strong authentication.

Security model

• Every user signs in with email + password + a 6-digit TOTP from an external authenticator app.
• Recovery codes are generated at enrollment; consume them once if you lose your device.
• All TOTP secrets are encrypted before being stored using authenticated encryption (Fernet, AES-128 in CBC + HMAC-SHA256).
• Passwords are hashed using Argon2id, a modern password hashing algorithm designed to resist GPU and ASIC attacks.
• Session cookies are HttpOnly, SameSite=Lax, and Secure in production.
• Rate-limited login and invite endpoints.
• Organization administrators can review an audit log of security-relevant events, including sign-ins, membership changes, and administrative actions.

Tenancy

Each organization is fully isolated. A single email address can have memberships in many organizations, with a different role in each. Switch organizations from the nav bar.

Privacy & advertising

We show advertising on public pages and the authenticated dashboard. We do not show advertising on sign-up, sign-in, or authenticator-enrollment pages, to keep those flows focused.

Beta status

Crew2FA is currently in public beta. While in beta:

• Features may be added, changed, or removed without prior notice.
• Encrypted TOTP secrets stored before an encryption key rotation will be transparently re-encrypted by the operator; the master key is the only thing that ever changes for you.
• While in beta, occasional downtime or unexpected issues may occur. We make every reasonable effort to prevent data loss, but recommend maintaining backup access to important accounts until the beta period concludes.
• Recovery codes are the only self-service way back into your account if you lose your authenticator — keep them somewhere safe.

Crew2FA is under active development. We welcome bug reports, feature requests, and security feedback at bug_report@crew2fa.com. In bug reports include what you did, what you expected, and what happened. Screenshots and reproduction steps are very welcome. Our goal is to build a service that teams can rely on for secure, accountable management of shared TOTP authenticators.