Free Online 2FA Code Generator

It is a convenient backup when your phone is lost, broken or out of reach, and a handy tool for developers testing a two-factor setup. Keep in mind that two-factor authentication is strongest when the second factor lives on a different device from your password, so a phone-based authenticator remains the better everyday choice.

The page follows the standards that authenticator apps use (RFC 4226 and RFC 6238). It divides the current Unix time by the period (30 seconds by default) to get a counter, signs that counter with your secret key using HMAC through your browser’s Web Crypto API, and turns four bytes of the result into a 6 to 8 digit number. No outside code library is loaded, and SHA-1, SHA-256 and SHA-512 are supported.

Yes, as long as the secret key and the settings are the same: the algorithm (usually SHA-1), the number of digits (usually 6) and the period (usually 30 seconds). A setup link or QR code carries all of these, so importing one is the most reliable way to match. The Check a code tool lets you compare against another app.

The page runs in your browser, loads no outside scripts, blocks outgoing network requests through its content security policy and saves nothing unless you create the optional encrypted vault. A secret is still only as safe as the device it is typed into, so use a device you trust and avoid shared computers.

If you choose to keep accounts on this device, the page derives an encryption key from your passphrase with PBKDF2-SHA-256 (600,000 rounds) and encrypts the accounts with AES-256-GCM before saving them in this browser. The passphrase is never stored, so a forgotten passphrase cannot be recovered. The vault locks itself after 10 minutes without activity. Export an encrypted backup as a second copy.

First check your device clock, because a clock that is off by even a minute produces codes that a service rejects. Then use Check a code: enter the code shown by another app and the tool tells you whether it matches this window, a neighbouring one (a clock difference) or none (a wrong key or setting). Also check the algorithm, digits and period.

TOTP (time-based) codes come from the current time and change every period, usually 30 seconds. HOTP (counter-based) codes come from a counter that goes up each time you ask for a new code, so they stay valid until used. Most services use TOTP. This page supports both and shows a Next code button for HOTP accounts.

When you turn on two-factor authentication, the service shows a QR code and usually a text key under it. Scan the QR code with the Scan tab, load a screenshot of it, or paste the key or the otpauth:// link. Google Authenticator’s export QR code (an otpauth-migration link) can also be read and imports all of its accounts at once. Services that use push approvals, SMS or their own scheme cannot be used here.

A random guess matches a 6-digit code with a chance of 1 in 1,000,000, or about 1 in 333,333 when a service also accepts the neighbouring time windows. That is weak on its own, so services limit failed attempts and the real protection is the secret key. Aim for a secret of at least 128 bits (26 Base32 characters), as RFC 4226 asks, although many services issue 80-bit keys.

Once the page has loaded, it makes no network requests, so codes keep working without a connection. Your device clock still has to be correct. To open the page later without internet, save it or install it through your browser if your browser offers that option.