2FA Code Generator
Generate TOTP two-factor authentication codes. Works offline. All computation in your browser.
Or scan QR code from 2FA setup
🔐
Your secret key never leaves your browser. All TOTP computation is done locally using the Web Crypto API.
How TOTP Works
TOTP (Time-based One-Time Password) is defined in RFC 6238. It generates a new 6-8 digit code every 30 seconds using a shared secret key and the current time. Both your device and the service you're logging into know the same secret, and they independently compute the same code.
The algorithm: (1) Decode your Base32 secret key into raw bytes. (2) Calculate the current 30-second time window counter. (3) Apply HMAC-SHA1 with the secret as the key and the counter as the message. (4) Extract a 6-digit code from the HMAC result through dynamic truncation.
All computation above happens in your browser using the Web Crypto API. This tool is entirely client-side — your secret key never leaves your device, is never sent to any server, and is never stored.
Frequently Asked Questions
Is it safe to enter my 2FA secret here? +
Yes. All computation happens locally in your browser using the Web Crypto API. Your secret key is never sent to any server, never stored, and never leaves your device. You can verify this by disconnecting from the internet — the tool continues to work offline after the initial page load.
Why show previous and next codes? +
If your device's clock is slightly out of sync with the server, the current code may not match. Showing the previous and next 30-second windows helps you identify if a clock drift issue exists. Many authenticator apps use the same approach internally (accepting codes from adjacent time windows).
What algorithms does this support? +
Currently supports TOTP with HMAC-SHA1, which is the most common algorithm used by services like Google, GitHub, Microsoft, and most other websites. Configurable digits (6-8) and period (30 or 60 seconds).
Can I use this instead of Google Authenticator? +
This tool can generate the same codes as Google Authenticator for any service that provides a standard TOTP secret (usually shown as a QR code or a Base32 string during 2FA setup). However, it does not store your keys — you'll need to re-enter the secret each time. For daily use, a dedicated authenticator app is more convenient.
What if my secret key gets exposed? +
If you suspect your 2FA secret has been compromised, immediately go to the affected service's security settings, disable 2FA, and re-enable it to generate a new secret key. The old key will be invalidated. Never share your 2FA secrets or store them in unencrypted files.