2FA Authenticator — Free, Browser-Based TOTP Generator
Generate time-based one-time passcodes (TOTP) right in your browser. Compatible with Google Authenticator, Authy, and any RFC 6238 service. Secrets are stored locally — never uploaded.
FreeNo sign-upRuns in your browserUtilitiesApplication
How TOTP codes work — and why yours might be rejected
A 2FA code is not sent to you; both sides compute it independently from a shared secret and the current time. Everything about TOTP that confuses people follows from that one design decision.
| Parameter | Standard value | What it means |
|---|
| Algorithm | HMAC-SHA1 | The default in RFC 6238 and what essentially every service issues |
| Digits | 6 | A few services issue 8 — the QR payload declares it |
| Period | 30 seconds | A new code every 30 s, derived from Unix time divided by 30 |
| Secret | Base32 string | The one value you must back up — the codes are derived from it |
| Drift window | Usually ±1 period | Most servers accept the previous or next code to tolerate clock skew |
- The overwhelmingly common failure is clock drift: if your device clock is more than about 30 seconds off, every code is rejected. Enable automatic time sync before assuming the secret is wrong.
- Because codes are computed, not delivered, TOTP works with no signal and no network — an authenticator on a plane still produces valid codes.
- Back up the Base32 secret (or the QR) when you enroll. Losing the device without it means account recovery, since the codes cannot be regenerated from anything else.
- Anything holding your secret is a credential store. Keep it somewhere you would keep a password, not in a screenshot in your camera roll.
How to generate 2FA TOTP codes in your browser
- Add an account. Click Add, then either paste the secret key shown by your service, or scan the QR code with your webcam.
- Name the account. Set a label like "GitHub" or "AWS" so you can find the right 6-digit code at a glance.
- Copy the live code. A 6-digit code refreshes every 30 seconds. Click the code to copy it instantly into the login prompt.
- Back up your secrets. Export your secret list to a local JSON file as backup. Store somewhere safe (1Password, encrypted drive) — never email it.
Frequently Asked Questions
- Are my 2FA secrets uploaded?
- No. Secrets are stored only in your browser localStorage. No server, no sync, no telemetry.
- Is this a Google Authenticator replacement?
- Yes. It implements the same RFC 6238 TOTP standard. Any service that supports Google Authenticator will work with this tool.
- What if I clear my browser data?
- You will lose your secrets unless you exported the backup. Always keep an exported backup before clearing browser storage.
- Can I scan QR codes from the screen?
- Yes. Use your webcam to scan a QR code displayed on another device, or upload a screenshot of the QR code.
- Does it work offline?
- Yes. After first load, the tool runs entirely offline — TOTP only needs the secret and your device clock.
- Why does my code not match?
- TOTP requires accurate clock sync. If your device clock drifts more than 30 seconds, codes will be rejected. Sync your system time.
Use Cases
- Replace Google Authenticator on a new laptop without phone setup
- Generate 2FA codes for AWS, GitHub, Cloudflare, Notion accounts
- Backup TOTP secrets to a portable, browser-based vault
- Test 2FA login flows during development
- Provide team-shared 2FA codes for shared service accounts (safely, with export backup)
Related tools
More free, in-browser tools from the More Tools set — every one runs locally, with no sign-up and no upload.
Browse all free online tools →