// Tools · account security
2FA code generator
Paste the 2FA secret (for example the 32-character key a seller sent you) or an otpauth:// link to get the current verification code. Works like a web version of Google Authenticator.
Runs on your device – nothing is uploadedRFC 6238 TOTPSHA1 · SHA256 · SHA5126/8 digits · 30/60 s
1. Secret key
Paste a secret or an otpauth:// link above.
Advanced: digits, period, algorithm
Most sites (Google, GitHub, Microsoft…) use 6 digits, 30 seconds, SHA1. An otpauth link fills these in automatically.
2. Verification code
–
Codes use your device clock. If a site keeps rejecting them, turn on automatic date & time.
⚠ This link IS the secret: anyone who opens it can generate your codes. The secret sits after “#”, which browsers never send to a server, and the page removes it from the address bar on load. Keep it only in a private bookmark; never share it.
01How to use
- Copy the 2FA secret (Base32, e.g. 32 characters) or the otpauth:// link and paste it into the box. Spaces, dashes and lower case are fixed automatically.
- The current code appears at once and refreshes every 30 seconds; the bar shows how long it is still valid. Click “Copy” and paste it into the login page.
- If the code is about to expire, wait for the next one (shown below the current code) to avoid a rejected login.
- Close the tab when you are done. Nothing is saved.
02Keep the secret safe
- The secret is as sensitive as your password: whoever has it can produce valid codes. Do not send it in chat or store it in shared documents.
- If the secret came from someone else (for example with a purchased account), re-bind 2FA in the account’s security settings to get a new secret that only you have.
- Keep a backup: save the secret or the site’s backup codes offline, so you can still log in if you lose your phone.
- How we keep it local: the code is computed with crypto.subtle in this page; the page sends no network request containing the secret, does not use cookies or localStorage for it, and keeps it out of the address bar and analytics. You can verify this in your browser’s developer tools (Network tab).
More small tools: all tools →
FAQ
Is this 2FA code generator safe? Is my secret uploaded?
The code is calculated on your device with the browser’s built-in Web Crypto API (RFC 6238 TOTP). The page has no code that sends the secret anywhere: no form submission, no URL query, no cookies or localStorage, and it is not included in analytics. Once the page has loaded it keeps working offline. Remember that anyone who has the secret can generate your codes, so treat it like a password.
Can I use it as a web version of Google Authenticator?
It uses the same standard as Google Authenticator and most authenticator apps (TOTP, by default SHA1, 6 digits, 30 seconds), so the same secret gives the same code at the same moment. This page does not save your secret – it is gone when you close the tab – so for everyday use keep the secret in an authenticator app on your phone.
Where do I find the 2FA secret key?
When you turn on two-step verification, the site shows a QR code; there is usually a “Can’t scan it?” or “Enter a setup key” link that reveals the secret in Base32 (letters A–Z and digits 2–7, often 16 or 32 characters). The QR code itself contains an otpauth:// link, which you can paste here directly.
Why does the site say my code is wrong?
TOTP codes depend on the clock, so first make sure your device time is set automatically; an error of more than about 30 seconds gives wrong codes. Then check that digits, period and algorithm match what the site uses (most use 6 digits, 30 seconds, SHA1). If the countdown is almost over, wait for the next code.
I bought an account that came with a 2FA secret. What should I do?
The seller still has that secret and can generate the same codes. After you log in, set up the authenticator again in the account’s security settings (this creates a new secret and invalidates the old one), and change the password and recovery email too.
Which formats are supported?
Base32 secrets (spaces and dashes are removed, upper or lower case), otpauth://totp/ links (secret, issuer, account, digits, period and algorithm are read automatically), 6 or 8 digits, 30 or 60 seconds and SHA1, SHA256 or SHA512. In browsers that support the BarcodeDetector API you can also read a QR code image locally. Counter-based HOTP and Steam Guard codes are not supported.