2FA Generator
Generate TOTP codes for two-factor authentication. No sign up required — everything runs in your browser.
Add a Key
Paste or type your Base32 secret to generate a code instantly. Spaces and padding are OK. The secret stays in this browser unless you choose to save it.
Enter a Base32 key to preview its current code.
Saving stores the secret in this browser only. Leave it unsaved for a one-time code.
How to use the 2FA Generator
This tool generates live TOTP (Time-based One-Time Password) codes — the 6-digit codes used by two-factor authentication apps like Google Authenticator, Authy, and 1Password. Follow the steps below to get started.
- 1
Find your secret key in your account settings
Go to the security or two-factor authentication settings of the account you want to protect (e.g., Google, GitHub, X/Twitter). Look for an option to enable an authenticator app. You'll be shown a QR code and a text secret key — the text key is what you need. It looks like
JBSWY3DPEB3W64TMand is always in Base32 format (letters A–Z and digits 2–7). - 2
Paste the secret key into the field above
Copy the Base32 secret from your account settings and paste it into the Secret Key field above. Spaces and
=padding characters are handled automatically — you don't need to clean the key up first. - 3
Preview your code instantly
As soon as you enter a valid secret, the current 6-digit code appears above and refreshes every 30 seconds. If no code appears, double-check that you copied the full Base32 key.
- 4
Save the key only if you want to reuse it
Saving is optional. Enter a label — for example GitHub Work or Gmail Personal — and choose Save Key to keep it in this browser. Otherwise, use the preview code without saving.
- 5
Copy the code when you need to log in
Click Copy on the preview or a saved code. Each code has a ring timer showing how many seconds remain before it refreshes. Codes update every 30 seconds.
Frequently asked questions
What is two-factor authentication (2FA)?
Two-factor authentication (2FA) is a security method that requires two separate forms of verification before granting access to an account. The first factor is your password; the second is a short-lived code generated by an authenticator app or device. Even if someone steals your password, they can't log in without also having the second factor.
What is a TOTP code?
TOTP stands for Time-based One-Time Password (defined in RFC 6238). It's a 6-digit code calculated from your secret key and the current Unix time, divided into 30-second windows. The code changes every 30 seconds and becomes invalid once that window closes. This is the standard algorithm used by Google Authenticator, Authy, Microsoft Authenticator, and most 2FA apps.
Where do I find my Base32 secret key?
When you enable 2FA on an account, the service shows you a QR code for authenticator apps. Next to or below that QR code there is always a plain-text fallback key — sometimes labelled "manual entry key", "setup key", or "secret". This is your Base32 secret. If you've already set up 2FA and didn't save the key, you'll need to disable and re-enable 2FA to see a new one.
Is it safe to enter my secret key here?
Code generation runs entirely in your browser — your secret key is never sent to a server. Saving is optional; if you choose to save a key, it stays in this site's localStorage. Treat your 2FA secret key like a password: don't share it or store it somewhere insecure.
Why does the code keep changing?
TOTP codes are valid for exactly 30 seconds. The ring timer on each code card shows the time remaining before the code rotates. If you're about to log in and the timer is at 2–3 seconds, it's safer to wait for the next code rather than risk it expiring mid-login.
Does this work offline?
Yes — once the page has loaded, code generation happens locally using your device's clock and the Web Crypto API. No internet connection is needed to generate a code. Saved keys are also available offline.
Can I use this instead of Google Authenticator or Authy?
For occasional or developer use, yes. However, a dedicated authenticator app on your phone is safer for daily use because it remains accessible if your browser data is cleared and works even without a browser. This tool is best suited for quickly verifying 2FA secrets, testing configurations, or accessing codes on a desktop without reaching for your phone.