Generate time-based one-time passcodes (TOTP) right in your browser. Compatible with Google Authenticator, Authy, and any RFC 6238 service. Secrets are stored locally — never uploaded.
FreeNo sign-upRuns in your browser
How TOTP codes work — and why yours might be rejected
A 2FA code is not sent to you; both sides compute it independently from a shared secret and the current time. Everything about TOTP that confuses people follows from that one design decision.
Parameter
Standard value
What it means
Algorithm
HMAC-SHA1
The default in RFC 6238 and what essentially every service issues
Digits
6
A few services issue 8 — the QR payload declares it
Period
30 seconds
A new code every 30 s, derived from Unix time divided by 30
Secret
Base32 string
The one value you must back up — the codes are derived from it
Drift window
Usually ±1 period
Most servers accept the previous or next code to tolerate clock skew
The overwhelmingly common failure is clock drift: if your device clock is more than about 30 seconds off, every code is rejected. Enable automatic time sync before assuming the secret is wrong.
Because codes are computed, not delivered, TOTP works with no signal and no network — an authenticator on a plane still produces valid codes.
Back up the Base32 secret (or the QR) when you enroll. Losing the device without it means account recovery, since the codes cannot be regenerated from anything else.
Anything holding your secret is a credential store. Keep it somewhere you would keep a password, not in a screenshot in your camera roll.
How to generate 2FA TOTP codes in your browser
Add an account. Click Add, then either paste the secret key shown by your service, or scan the QR code with your webcam.
Name the account. Set a label like "GitHub" or "AWS" so you can find the right 6-digit code at a glance.
Copy the live code. A 6-digit code refreshes every 30 seconds. Click the code to copy it instantly into the login prompt.
Back up your secrets. Export your secret list to a local JSON file as backup. Store somewhere safe (1Password, encrypted drive) — never email it.
Frequently Asked Questions
Are my 2FA secrets uploaded?
No. Secrets are stored only in your browser localStorage. No server, no sync, no telemetry.
Is this a Google Authenticator replacement?
Yes. It implements the same RFC 6238 TOTP standard. Any service that supports Google Authenticator will work with this tool.
What if I clear my browser data?
You will lose your secrets unless you exported the backup. Always keep an exported backup before clearing browser storage.
Can I scan QR codes from the screen?
Yes. Use your webcam to scan a QR code displayed on another device, or upload a screenshot of the QR code.
Does it work offline?
Yes. After first load, the tool runs entirely offline — TOTP only needs the secret and your device clock.
Why does my code not match?
TOTP requires accurate clock sync. If your device clock drifts more than 30 seconds, codes will be rejected. Sync your system time.
Use Cases
Replace Google Authenticator on a new laptop without phone setup
Generate 2FA codes for AWS, GitHub, Cloudflare, Notion accounts
Backup TOTP secrets to a portable, browser-based vault
Test 2FA login flows during development
Provide team-shared 2FA codes for shared service accounts (safely, with export backup)