Get a two-factor code from a setup key
Paste the key a site gave you, or its otpauth:// link, and
the current code appears. It is worked out in this page: the key is never sent
anywhere and never kept. Close the tab and it is gone.
6 digits · every 30 s · SHA-1 —
Next:
Is it safe to paste a key here?
This page cannot send it. Its Content Security Policy forbids it to load or send anything, and to run any script but its own — rules your browser enforces, whatever anyone serving the page might want. It loads nothing from anywhere else, and keeps working with the network off once it has opened.
Still, a web page is for checking a key or getting one code in a pinch, not for keeping keys. For the accounts you use, an authenticator app keeps them encrypted and ready.