Free Online 2FA Authenticator — TOTP Code Generator
Generate RFC 6238 Time-Based One-Time Password (TOTP) codes directly in your browser — for as many accounts as you need, with live countdown rings, one-click copy, and a QR code per account for your phone app. Import a single secret, an otpauth:// link, or a whole bulk list, test codes against backends, and keep everything private: secrets are never sent to, stored on, or logged by any server.
No accounts yet
Add one above — or press “Try a demo account” to see a live code with zero setup.
How to Use
- 1Add an account: paste a Base32 secret, an otpauth:// link, or a bulk list — or try the labeled demo account first.
- 2Watch its live code rotate with the countdown ring; tap Copy code before the window ends.
- 3Tap Show QR to scan the account into your phone's authenticator app, or use the code checker to test a backend.
- 4Switch on Save on this device only if you want accounts kept in this browser — otherwise they vanish when the tab closes.
Key Features
- ✓
Many accounts, one live board
Add as many accounts as you need — each with its own live code, countdown ring, and copy button, all refreshing on the same 1-second tick. Search filters the board instantly when the list grows.
- ✓
Every algorithm, digit length, and period the standard allows
SHA-1, SHA-256, and SHA-512; 6 or 8 digits; 30- or 60-second periods. The defaults (SHA-1, 6 digits, 30 seconds) match Google Authenticator and almost every service, while the options cover the backends that deviate.
- ✓
Import three ways — single secret, otpauth link, or bulk list
Paste one Base32 secret, paste an otpauth://totp/ link (issuer, label, secret, algorithm, digits, and period are all read from it), or paste a whole list — raw secrets, “Label | Secret”, or “User | Pass | Secret” lines. Bad lines are reported with their line number and skipped; the rest still import.
- ✓
A QR code for every account — drawn in your browser
No opened competitor shows one: tap “Show QR” and the account's otpauth link is rendered as a QR code right here, so you can scan the account into your phone's authenticator app. The QR is drawn client-side from the link — it is never uploaded anywhere.
- ✓
Test a code against an account (±1 window)
For developers testing a login backend: paste a code from another app and check it against an account across the previous, current, and next time windows — the ±1 grace most servers allow — with a plain-English verdict instead of a silent mismatch.
- ✓
One-click demo mode, zero setup
“Try a demo account” adds a clearly labeled demo account so you can watch a live code rotate before trusting the tool with a real secret. Demo codes are meaningless by design — they come from a public example secret.
- ✓
Private by default, saved only when you say so
Accounts live only in the current tab unless you switch on “Save on this device” — then they are stored in this browser's local storage, on this device only, with a one-click “Forget saved accounts” that wipes them. Secrets are never sent to, stored on, or logged by any server, ever.
- ✓
A note and a code history on every account
Jot a note on any account — “backup codes in the diary”, “work laptop only” — and open its history to see the last 20 codes it generated, each stamped with the window it was valid for and marked expired once it rolls over. Notes and history follow exactly the same rule as the accounts themselves: this browser only, kept on this device only when you opt in, never uploaded.
- ✓
Specific errors, not a dead code box
A secret with a 0, 1, 8, or 9, padding in the middle, a too-short key, or a malformed otpauth link each gets its own plain message telling you exactly what is wrong — instead of a generic “invalid secret” that sends you guessing.
Frequently Asked Questions
Is it safe to enter my real 2FA secret here?
How does TOTP authentication work?
Why is my code rejected by the service?
What is an otpauth:// link?
Can I save accounts for later?
TOTP vs SMS codes vs passkeys — which is best?
I lost my phone — how do I get back into my accounts?
How TOTP codes actually work
When you switch on two-factor authentication, the service shows you a QR code that hides a shared secret — a Base32 string it also stores for your account. From then on, both sides independently combine that secret with the current time, in 30-second windows, through HMAC hashing (RFC 6238), and truncate the result to 6 or 8 digits. The codes match because the secret and the clock match — nothing is transmitted during sign-in, which is why a TOTP code cannot be intercepted the way an SMS code can be SIM-swapped. If a code is rejected, the usual culprits are a wrong secret, a mismatched algorithm or digit length, or a device clock that has drifted; most servers accept the previous and next windows as grace for exactly that reason, and this tool's code checker shows all three windows.
TOTP vs SMS codes vs passkeys
SMS codes travel over the phone network and can be intercepted or redirected; TOTP codes are computed on a device you hold and never travel at all, which is why security guides rank TOTP above SMS. Passkeys go further — they are phishing-resistant by design, because the credential is bound to the real site and cannot be pasted into a fake one. Where a service offers a passkey, take it; where it offers only TOTP, use an authenticator on a separate device for your most valuable accounts, and treat a browser authenticator like this one as the convenient second place for codes, testing, and recovery — never the only copy of a secret. Always save the backup codes a service gives you at setup time.
If you lose your phone
- Use the backup codes from setup — that is what they are for. Keep them somewhere a phone thief cannot reach (printed, or in a password manager).
- If the service offers account recovery, start it immediately; some services take days to verify identity.
- When you regain access, revoke the old authenticator and enroll the new one — do not keep a lost device's secrets valid.
- For the future, keep a second copy of each secret in a password manager that supports TOTP, or export accounts from your authenticator app while you still have the phone.
Keep your other secrets safe, too
Two-factor authentication only helps if the first factor is strong. The password generator builds high-entropy passwords in your browser, the QR code generator makes the same kind of scannable codes for links, Wi-Fi, and contact cards, and the JWT decoder inspects login tokens the same client-side way. Secrets of any kind can also be packed and unpacked with the Base64 encoder & decoder when a service hands you an encoded key.
Related Tools You Might Like
Handy utilities in Developer Tools
QR Code Generator
Make free QR codes online with your logo, colors and dot styles — URL, WiFi, vCard, WhatsApp. Download PNG or SVG. Static codes that never expire.
Password Generator
Free password generator with exact entropy maths: strong random passwords, EFF passphrases and pronounceable mode. 100% client-side — nothing leaves your browser.
JWT Decoder & Verifier
Free JWT decoder and verifier: decode header, payload and claims, check expiry with a live countdown, and verify HS256/RS256/ES256 signatures in your browser. Tokens never leave your device.