Get your 2FA code
2FA Authenticator - Online TOTP Code Generator
Paste a TOTP secret or an otpauth link and read your current 6-digit code, with a live countdown. Everything runs in your browser.
Two-factor authentication (2FA) adds a second step to logging in: after your password, the site asks for a short code that changes every 30 seconds. This page is a free, browser-based 2FA authenticator that turns your secret key into that 6-digit code on demand. It works the same way Google Authenticator or Authy does, except there is no app to install and nothing ever leaves your device.
What this tool does
Most 2FA today uses TOTP - Time-based One-Time Password. When you turn on 2FA for an account, the service gives you a secret key (a short string of letters and numbers, usually shown as a QR code). Your authenticator app stores that secret and, every 30 seconds, combines it with the current time to produce a fresh 6-digit code. The server does the same calculation on its side, so both sides land on the same number without ever exchanging it.
This page performs that exact calculation. Paste your secret (or a full otpauth:// link), and it computes the code locally using the standard TOTP algorithm defined in RFC 6238. Because the math runs entirely in your browser through the Web Crypto API, it is a private, install-free alternative to a dedicated app when you just need to read your current code - for example on a computer where you do not have your phone handy.
How to use it
- Open the 2FA setup page of the service you are securing (usually under Settings -> Security -> Two-factor authentication).
- Copy your secret key - the text code shown next to the QR image - or copy the full otpauth link if the service exposes one.
- Paste it into the box above and press Get code.
- Read the 6-digit code and type it into the site before the countdown ring runs out. When the timer resets, the tool generates the next code automatically.
Where do I find my secret key?
When a site walks you through enabling 2FA, it shows a QR code so authenticator apps can scan it. Right under (or beside) that QR image there is almost always a link like "Can't scan the code? Enter this key manually". Clicking it reveals a text string such as JBSW Y3DP EHPK 3PXP. That text is your secret key - the exact thing you paste into the box above. Spaces and lower/upper case do not matter; the tool cleans them up for you.
If your service lets you export or copy a full otpauth://totp/... link, you can paste that instead - the tool reads the secret, digit count, period, and algorithm straight from the link.
How to use it with a new account
Here is the common trap. You sign up for a new service using a temporary phone number, verify with the one-time SMS, and get in. Great - but you cannot reuse that number later. If the account then offers SMS-based 2FA, you would be tying your login to a number you no longer control, which can lock you out for good.
The fix is to switch to app-based TOTP 2FA the moment the account is created. TOTP does not depend on your phone number at all - it only needs the secret key. So during setup, choose "Authenticator app" instead of "Text message", save the secret key somewhere safe, and use it here (or in a proper authenticator app) to generate codes. Your logins stay secure even though the original phone number is long gone.
If you are creating that account right now, grab a virtual number for the initial signup at sms.1mail.lt, pair it with a clean generated identity and a disposable inbox from 1mail.lt, then immediately move the account onto TOTP 2FA using the secret you save.
Is this safe?
Yes, in the sense that matters most: your secret never leaves your device. The code is computed with the browser's native Web Crypto engine, there is no network request carrying your secret, and nothing is written to disk - no cookies, no localStorage. Close the tab and it is gone.
That said, this tool is designed for quickly getting a code - when you are at a desktop, do not have your phone, or just want to test that a secret is valid. It is not a place to permanently store your 2FA secrets. For long-term use, keep your secrets in a dedicated authenticator app or a password manager with built-in TOTP, ideally with an encrypted backup. Treat your secret key like a password: anyone who has it can generate your codes.
Pair a fresh number with a generated identity and a temporary email from 1mail.lt, then lock the account with TOTP 2FA from day one.
FAQ
Is my secret sent anywhere?
No. The 6-digit code is computed entirely inside your browser using the Web Crypto API. Your secret is never uploaded, never logged, and never stored - not in cookies, not in localStorage. When you close or reload the page, it is wiped from memory.
What is TOTP?
TOTP stands for Time-based One-Time Password (RFC 6238). It combines a shared secret key with the current time - divided into 30-second windows - and runs an HMAC hash to produce a short numeric code. Because both you and the server know the secret and the time, you both compute the same code without ever transmitting it. This is the standard behind almost every "authenticator app" 2FA.
Does it work like Google Authenticator?
Yes. Google Authenticator, Authy, Microsoft Authenticator, and this tool all implement the same TOTP standard. Given the same secret at the same moment, they all produce identical codes. The difference is that those apps store your secrets on your phone, while this page just calculates the current code on the spot and keeps nothing.
Why is my code rejected?
TOTP is time-based, so the usual culprit is a clock that is off. If your device's time is wrong by more than about 30 seconds, the code will not match - set your clock to automatic/network time and try again. Also remember each code is only valid for its 30-second window: if the countdown ring is about to empty, wait for the next code rather than submitting the expiring one. Finally, double-check you pasted the full, correct secret with no missing characters.
Can I use otpauth links or QR export?
Yes. If your service gives you an otpauth://totp/... link (some let you copy or export one), paste the whole link into the box. The tool reads the secret plus any digits, period, and algorithm parameters directly from it. If you only have a QR code, use the "enter this key manually" option on the setup screen to reveal the text secret and paste that.