2FA Code Generator (TOTP)
Paste a 2FA secret key and get the live 6-digit TOTP code, refreshed every 30 seconds. Runs entirely in your browser, your secret never leaves your device.
Add a secret key above to start generating 2FA codes. They’ll appear here and refresh automatically.
Your secret key is processed only in your browser using the Web Crypto API, and saved accounts stay in your browser's local storage. Nothing is ever uploaded to or stored on our servers.
More Developer Tools
How to use 2FA Code Generator (TOTP)
- 1Open the account where you set up two-factor authentication and choose “set up authenticator app”.
- 2Click “Can’t scan / enter key manually” to reveal the secret key (a string of letters and numbers).
- 3Paste that secret key here (and an optional name like “GitHub”), then click “Add”.
- 4A 6-digit code appears and refreshes every 30 seconds. Copy it and enter it when logging in.
About the 2FA (TOTP) Code Generator
Two-factor authentication (2FA) adds a second step to logging in: a short code that changes every 30 seconds. Apps like Google Authenticator, Authy and Microsoft Authenticator create these codes from a secret key using the open TOTP standard (RFC 6238). This free tool does exactly the same thing, right in your browser.
Paste the secret key you were given when enabling 2FA and you’ll get the current 6-digit code instantly, with a countdown to the next refresh. It’s handy for developers and testers, or when you need a code on a device that doesn’t have your authenticator app installed. Because everything is computed locally with the Web Crypto API, your secret never leaves your device.
Frequently asked questions
How do I generate a 2FA code from a secret key?
Paste the secret key (the long code shown during 2FA setup, e.g. JBSWY3DPEHPK3PXP) into the box and click Add. The tool instantly shows the current 6-digit TOTP code and refreshes it every 30 seconds, just like Google Authenticator or Authy.
Is it safe to put my 2FA secret here?
This tool runs 100% in your browser — your secret key is never uploaded to or stored on any server. Codes are computed locally with the Web Crypto API. Saved accounts stay only in your own browser (localStorage). Still, only paste secrets for accounts you own.
What is TOTP?
TOTP (Time-based One-Time Password, RFC 6238) is the standard behind 2FA apps. It turns your secret key + the current time into a 6-digit code that changes every 30 seconds. This tool implements the exact same algorithm.
Why is my code rejected?
Make sure (1) you pasted the secret key correctly (no missing characters), and (2) your device clock is accurate — TOTP depends on the correct time. If your clock is off by more than ~30 seconds, codes won’t match.
Where does the secret key come from?
When a site sets up 2FA, instead of scanning the QR code choose “enter a setup key / can’t scan”. It shows a secret like JBSWY3DPEHPK3PXP — that is your key. Keep it private; anyone with it can generate your codes.
Do you store my accounts or codes?
No. Accounts you add are saved only in your own browser so they’re there next time. Nothing is sent to our servers. Clear them anytime with the remove button or by clearing your browser data.
Can I use this as my main authenticator?
It works for quickly getting a code, but for daily security use a dedicated app (Google Authenticator, Authy, 1Password). This is best for developers, testers, and getting a code on a device without your authenticator.