Two-factor that isn't a spare key
Standard TOTP, six digits, thirty seconds — and why in a zero-knowledge vault it protects unlocking, not recovery.
Six digits, thirty seconds, any authenticator.
SEES implements ordinary time-based one-time passwords: six digits on a thirty-second step, the same scheme your authenticator app already speaks. Nothing proprietary, no SMS, no phone number, no push service in the middle.
It gates unlocking, not decryption.
This is the part worth being precise about. In most services, 2FA guards an account, and the provider can decrypt your data once you are through. Here there is no account to guard and no provider-side decryption to reach. 2FA adds a second local check in front of the unlock step.
Turning it on does not create a way back in.
Some services treat a second factor as a recovery path. SEES cannot, because the passphrase is the only input to the key. Enabling 2FA does not weaken that, and losing your passphrase still means losing the vault — with 2FA on or off.
Why there is no recovery at all