Free 2FA Code Generator for TOTP Secret Keys
Paste a 2FA secret key or otpauth:// link, or upload the QR code image, and get the current 6-digit code. It follows RFC 6238, the standard used by authenticator apps, and runs entirely in your browser.
- Key never leaves this tab
- Tested against RFC 6238
- No sign-up
Enter a secret key below to see your code.
Spaces, dashes and lowercase letters are fine. The key stays in this tab.
Settings SHA-1, 6 digits, 30 seconds
Most sites use SHA-1, 6 digits and 30 seconds. If you paste an otpauth:// link or scan a QR image, these are filled in for you.
Your device time: --:--:--
Shortcut: C copy code
For developers and admins testing 2FA in their own app. For a real account, use the key the site gives you.
160-bit is the length RFC 4226 recommends and what most services use.
How to test it
- Scan this QR code with an authenticator app or your phone's password manager.
- If your phone asks whether to save a code without a website, choose Save Anyway or the equivalent option.
- Press Show codes for this secret to open the same key in the Get a code tab.
- Compare the code on your phone with the one on this page. They should match.
- Wait for the timer to roll over. The code should change in both places and still match.
If they differ, check that your phone's clock is set automatically.
How this 2FA code generator works
Your key plus the clock
Your browser performs the HMAC calculation required by the TOTP standard, using the same secret and time-based calculation defined by RFC 6238.
Nothing is sent or saved
The key lives in this tab's memory and is gone when you close or reload it. QR images are read on your device. Only your light or dark theme choice is remembered.
A tool, not your authenticator
Use it to test a key, finish a setup or get back in with a saved key. For everyday sign-in, keep your keys in an authenticator app or password manager instead of pasting them into web pages.
Check it yourself. Open your browser's developer tools (F12), choose the Network tab and paste a key. Generating codes makes no network requests. The only downloads are two small QR libraries from jsDelivr: one when you first scan an image in a browser without built-in QR reading, and one when you first open Create a test secret. Your key is never part of any request.
2FA problems this tool fixes
Find the problem you ran into. Each fix takes you straight to the part of the tool that solves it.
| Your problem | How this tool fixes it | Fix |
|---|---|---|
| The code isn't accepted | ||
| "Invalid code", even though I typed it straight away | Codes depend on your device clock. The tool shows your device time so you can compare it with a clock you trust, and shows the next code when the current one is about to expire. | |
| My codes don't match my authenticator app | The site may use SHA-256, 8 digits or a 60-second period. Change them under Settings, or paste the full otpauth:// link so they're set for you. | |
| "Invalid key" or an error when I paste the key | Keys only use the letters A to Z and the digits 2 to 7. The tool points to the character that doesn't belong, such as a 0 that should be the letter O. | |
| I only have part of the setup | ||
| I only have the QR code, not the key | Upload a screenshot or photo with Scan QR image. The tool reads the key, site name and settings from it, on your device. | |
| I have a long otpauth:// link | Paste the whole link into the key box. The secret, site, account, algorithm, digits and period are all taken from it. | |
| The site shows the key in groups, like "jbsw y3dp ehpk 3pxp" | Paste it exactly as shown. Spaces, dashes and lowercase letters are cleaned up automatically. | |
| Recovery and testing | ||
| I lost my phone, but I saved my secret key | Paste the saved key to get a code and sign in. Then remove the old authenticator method and set up 2FA again on your new device using the site's account-security settings. | |
| I'm adding 2FA to my app and need a test key | Create a test secret makes a random key, its otpauth:// link and a QR code, then shows the codes it produces so you can compare them with your server. | |
How a TOTP code is calculated
Time-based one-time passwords (TOTP) are defined in RFC 6238. Your secret key is shared once, usually through a QR code, and after that your device and the site calculate the same code on their own. Nothing is sent between them.
step = floor(current Unix time ÷ 30)
hash = HMAC-SHA-1(secret key, step)
code = last 6 digits of a 31-bit number taken from the hash
Because the step changes every 30 seconds, so does the code. If your clock is a minute off, you're on a different step and the site calculates a different code. Many sites accept the code from one step before or after to allow for small delays, which is why a code sometimes works a few seconds after it changes.
The secret key is written in Base32, an alphabet of 26 capital letters and the digits 2 to 7. The digits 0, 1, 8 and 9 are left out because they're easy to confuse with O, I, B and g.
Sources: RFC 6238 (TOTP), RFC 4226 (HOTP), RFC 4648 (Base32).
2FA mistakes that lock people out or let attackers in
Two-step verification only helps when the key and the codes stay with you.
A zero instead of the letter O. Base32 has no 0, 1, 8 or 9, so one mistyped character makes every code wrong.
Sharing a code with a caller or chat. No bank, courier or support team needs your code. Someone asking for it is trying to sign in as you.
Keeping the setup QR as a photo. It contains the full secret key, and photos often sync to the cloud. Store the key in a password manager instead.
Skipping the backup codes. If your phone is lost, those one-time codes are often the only way back in without a long recovery process.
2FA habits that actually matter
Do
- Turn on two-step verification for your email first, since it can reset every other account.
- Save backup codes somewhere safe and offline, or in your password manager.
- Keep your device clock on automatic date and time.
- Use a passkey or security key when a site offers one.
- Set 2FA up again when you change phones, rather than moving old screenshots across.
Avoid
- Sharing a code or a secret key with anyone, by phone, chat or email.
- Pasting secret keys into websites on shared or public computers.
- Keeping the only copy of your key on one phone.
- Relying on SMS codes when an authenticator app is available.
- Approving sign-in prompts you didn't start.
Frequently asked questions
Short answers about key safety, codes that fail, otpauth links and SMS.
Is it safe to paste my 2FA secret key here?
The key is used only inside this browser tab. Codes are calculated on your device with the Web Crypto API, and the key is never sent to our servers or saved. Anyone who sees your key can make your codes, though, so use this page only on your own device and press Clear when you're done.
Why is my 2FA code not working?
Most failures come from one of four things: the device clock is wrong, the settings don't match the site (algorithm, digits or period), part of the key was copied wrongly, or the code expired while you typed it. Turn on automatic date and time, paste the full otpauth:// link if you have it, and enter the code with a few seconds left.
Which sites does this work with?
Any site that offers an "authenticator app" option during two-step setup, such as Google, Microsoft, GitHub and Amazon, uses the TOTP standard this tool follows. Codes sent by SMS or email, and sign-in prompts inside a company's own app, can't be generated here.
Can this replace Google Authenticator or another authenticator app?
No. It's useful for testing, for recovering access when you have your secret key saved, and for checking that a key works. For day-to-day sign-in, an authenticator app keeps your keys on your phone and works offline, which is safer than pasting keys into a web page.
What is an otpauth:// link?
It's the text hidden inside a 2FA QR code. It holds the secret key plus the site name, account and settings, for example otpauth://totp/GitHub:you?secret=...&period=30. Paste the whole link here, or upload the QR image, and the tool reads the settings for you.
Why do the codes change every 30 seconds?
The code is calculated from your secret key and the current time, counted in 30-second steps. When a new step starts, the code changes. Some sites use 60 seconds instead, which the Period setting handles.
Is SMS two-step verification safe enough?
A passkey provides stronger protection against phishing. An authenticator app also avoids SIM-swap risks associated with SMS, although TOTP codes can still be phished. Use whichever stronger option the site supports.