Enter your 2FA secret key to generate real-time TOTP authentication codes. Works with any service that uses standard TOTP - Google, GitHub, Discord, and more.
The secret key is the Base32-encoded string you receive when setting up 2FA on a service (e.g. E7DLE2XJWY7CZ45F).
Our 2FA generator implements the standard TOTP algorithm (RFC 6238) used by all major authenticator apps - running entirely in your browser.
Generate time-based one-time passwords that refresh every 30 seconds, fully compliant with RFC 6238.
Scan the generated QR code with any authenticator app like Google Authenticator, Authy, or 1Password.
Each secret key gets a unique, bookmarkable URL you can save or share for quick access.
All code generation happens in your browser. Your secret key is never sent to any server.
Two-Factor Authentication (2FA) adds an extra layer of security to your accounts by requiring a second form of verification beyond your password. The most common method is Time-Based One-Time Passwords (TOTP), which generates a new 6-digit code every 30 seconds using a shared secret key.
When you enable 2FA on a service, you receive a Base32 secret key (often displayed as a QR code). This key is used by authenticator apps to generate time-synced codes that prove you have physical access to your device. Our tool lets you generate these codes directly in your browser - no app installation required.
Security Note: This tool runs entirely client-side. Your secret key never leaves your browser and is not stored or transmitted anywhere. However, for maximum security, we recommend using a dedicated authenticator app for production accounts.
Two-Factor Authentication (2FA) adds an extra layer of security by requiring a second form of verification beyond your password. The most common method is Time-Based One-Time Passwords (TOTP), which generates a new 6-digit code every 30 seconds using a shared secret key.
TOTP (Time-Based One-Time Password) uses a shared secret key and the current time to generate a unique 6-digit code every 30 seconds. The algorithm (RFC 6238) combines HMAC-SHA1 with a time-based counter, ensuring both your device and the server generate the same code at the same time.
Yes, this tool runs entirely client-side in your browser. Your secret key is never sent to any server or stored anywhere. All code generation happens locally using the Web Crypto API. However, for maximum security on production accounts, we recommend using a dedicated authenticator app.
This tool works with any service that uses standard TOTP two-factor authentication, including Google, GitHub, Discord, Twitter/X, Facebook, AWS, Microsoft, Coinbase, Binance, Dropbox, WordPress, Steam, and thousands more.
