Built a Free Security Tool Site from Scratch — 2faco.com | 54 Articles, 20 Tools

Hey BHW,

Started this project about 3 weeks ago and figured I'd document the journey here. The site is 2faco.com — a free, browser-based security toolkit focused on 2FA and password security tools.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CURRENT STATS (Week 3)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Active users: 238/week (+693% WoW)
• Page views: 686/week (+1,245% WoW)
• Sessions: 418/week (+919% WoW)
• Organic search: 33 sessions (+3,200% WoW) ← just starting to pick up
• Top countries: US (89), India (69), Vietnam (12), Nigeria (9), Germany (8)
• AdSense: Submitted ~Mar 5, currently "Getting Ready"
• GSC: 84 URLs indexed, redirect errors now fixed

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
️ WHAT THE SITE HAS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

20 Tools:
• TOTP/2FA Code Generator (main tool — works like Google Authenticator in browser)
• Password Generator + Passphrase Generator
• Username Generator, Random Number Generator
• Phone Number Generator (12 countries with real area codes)
• Name Generator (20 cultures — US, Indian regional, Japanese, Arabic, Korean, etc.)
• IP Address Lookup, QR Code Scanner, Hash Generator (MD5/SHA)
• JWT Decoder, HMAC Generator, UUID Generator, Base32 Encoder
• BCrypt Generator, Unix Timestamp, OTPAuth URI Builder
• Best Password Managers + Best Authenticator Apps (comparison pages)

54 Articles:
All targeting 2FA-related keywords — how-to setup guides for Gmail, Discord, Steam, Roblox, Fortnite, Epic Games, Apple ID, etc. Plus explainer articles on phishing, SIM swapping, backup codes, hardware keys, etc.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TECH STACK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Pure HTML/CSS/JS — no framework, no backend
• Hosted on Cloudflare Pages (free tier)
• PWA enabled (installable on mobile)
• All tools run 100% client-side — nothing sent to any server
• GA4 analytics deployed across all pages

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TRAFFIC SOURCES BREAKDOWN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Direct: 304 sessions (contact sharing campaign worked)
• Referral: 57 sessions
• Organic Search: 33 sessions — articles starting to rank after 3 weeks
• Cloudflare analytics: 4,230 requests/24h but ~43% are bots (China/WordPress scanners)


Happy to answer any questions. Would love feedback from anyone who's monetised a tool-based site with AdSense — what RPM are you seeing in the security/privacy niche?

[SITE] 2faco.com

The site looks great, and it seems to be doing well for such a recent site. Most of your traffic is coming from your contact sharing campaign: can you share more details on how you did it?

serponaut said:

The site looks great, and it seems to be doing well for such a recent site. Most of your traffic is coming from your contact sharing campaign: can you share more details on how you did it?

Click to expand...

Thanks for the kind words!

The contact sharing campaign was pretty simple honestly — nothing fancy.

I basically went through my WhatsApp contacts and groups and sent a short personalised message explaining what the site does and why it might be useful to them. The key was framing it around the privacy angle — "everything runs in your browser, nothing is uploaded to any server" — which resonated well because people are increasingly paranoid about online tools stealing their data.

I also sent a slightly more detailed version to professional contacts and a few tech-oriented group chats explaining the full tool list.

The spike you can see on March 11 in the GA4 data was almost entirely from that one afternoon of sharing. Got 304 direct sessions that week vs basically nothing the week before.

A few things that helped:
- Kept the message short and led with the most relatable tool (the 2FA generator — most people have heard of Google Authenticator)
- Didn't ask people to share it further, just to check it out — less pressure = more genuine engagement
- Sent to people who would actually find it useful rather than mass blasting everyone

The referral traffic came from people who then shared it themselves without being asked, which was a good sign.

[SITE] 2faco.com