About this tool
Two-factor authentication (2FA) adds a second check after your password: a time-based code that changes every 30 seconds. The 2FA Code Generator computes those codes for you, entirely inside your browser. Paste a Base32 secret or an otpauth:// URI — the kind a QR code from Facebook, Telegram, Gmail, or your bank contains — and the tool shows the current code with a countdown to the next one. It also decodes otpauth:// URIs so you can see exactly what an app is asking you to scan.
How it works
Paste your secret (Base32) or a full otpauth:// URI into the box. The tool parses the parameters — algorithm (SHA-1, SHA-256, SHA-512), digits (6 or 8) and period (30 or 60 seconds) — and computes the current code using the standard TOTP algorithm (RFC 6238). A ring counts down the seconds until the code changes. Nothing is sent to any server: the computation uses the browser’s built-in crypto functions and the secret exists only in the page’s memory.
Use cases
- Read a code from a backup secret when your phone is being repaired.
- Check what an otpauth:// URI from a QR code actually contains before scanning it.
- Generate codes on a second device when you are setting up a new phone.
- Verify that an authenticator app and this tool produce the same code from the same secret.
Frequently asked questions
Is my secret sent anywhere?
No. The secret never leaves your browser. Codes are computed locally and nothing is transmitted, logged, or stored on this site.
Why do my codes not match my authenticator app?
Check the algorithm, digits and period. Most services use SHA-1, 6 digits, 30 seconds, but banks and newer services sometimes use SHA-256 or 8 digits. If you pasted a URI, these are read from it automatically.
Is this tool a replacement for an authenticator app?
No. This is a convenience reader, not a secure replacement. Use a dedicated authenticator app on your own device for real 2FA, and treat a secret pasted into any website as compromised if the device is shared.
What is the difference between SMS and app-based 2FA?
App-based codes (TOTP) are generated on your device and work offline. SMS codes can be intercepted or blocked when your number is compromised, which is why app-based 2FA is strongly preferred.
I lost my phone. How do I get back into my accounts?
Use the recovery codes you saved when you enabled 2FA. This is why recovery codes matter — keep them somewhere safe and offline.