2FA Code Generator
Paste your Base32 2FA secret key and get a working six-digit two-factor authentication code instantly. It runs the same RFC 6238 TOTP algorithm as Google Authenticator, Microsoft Authenticator and Authy, so the one-time password it produces is accepted on Binance, GitHub, Discord, Facebook, X and anywhere else 2FA is switched on.
Enter your 2FA key and get your verification code instantly.
appear here
Your verification code
Click to copy
What Is a 2FA Code?
A 2FA code is a six-digit one-time password that proves you hold a second factor besides your password. Services call it a two-factor authentication code, a verification code, or simply an OTP. The standard behind almost all of them is TOTP — Time-based One-Time Password, defined in RFC 6238.
When you switch two-factor authentication on, the service shows you a secret key: a short string of letters and digits in Base32, such as JBSWY3DPEHPK3PXP. That key and the current time go through the same calculation on both sides, which is why your authenticator and the service arrive at identical codes without ever talking to each other. The result changes every 30 seconds, so an intercepted code is worthless almost immediately.
Anything that implements the standard produces the same code from the same key — there is no Google-only or Authy-only code. That is what lets this page stand in for an authenticator app when your phone is not to hand. For the background, read what two-factor authentication is and how the TOTP algorithm builds each code.
How to Generate a 2FA Code From Your Secret Key
1. Paste Your Base32 2FA Key
Paste the Base32 secret key from your account's 2FA setup page.
2. Get Your Six-Digit TOTP Code
A 6-digit verification code appears instantly. It refreshes every 30 seconds automatically.
3. Copy the Code and Sign In
Click the code to copy it, then paste it wherever you need to log in. Your key stays in your browser only.
Is It Safe to Generate 2FA Codes in a Browser?
It depends entirely on where the calculation happens. Some online 2FA generators send your secret key to their own server and send a code back — which means the operator sees the key that protects your account. This page does not work that way.
Your code is computed in your browser with the Web Crypto API, and you can prove it in ten seconds: open your browser's Network tab and watch that nothing is sent, or simply disconnect from the internet once the page has loaded. The generator keeps working, because there is nothing to send. For high-value accounts — your bank, your main email, a crypto wallet — a hardware key or an app on your own device is still the right choice, and the security page says exactly when to use which.
Privacy, and How to Verify It Yourself
This tool uses the Web Crypto API built into your browser to generate TOTP codes. That means:
- No server contact: After the page loads, no network requests are made. You can verify this in your browser's Developer Tools → Network tab.
- No storage: Your secret key is held only in browser memory while the tab is open. Closing the tab erases it. No cookies, no localStorage, no databases.
- No tracking: No analytics scripts, no third-party resources, no fingerprinting. The page does not phone home.
- Open standard: The code generation follows RFC 6238 (TOTP) and RFC 4226 (HOTP), the same standards Google Authenticator and every major authenticator app use.
If you want to go further, disconnect from the internet after this page loads. It will continue to work offline.
Want the full threat model, including when not to use this tool? Read the security page.
2FA Code Generator FAQ
A 2FA code is the six-digit one-time password a service asks for after your password. Most are TOTP codes, generated from a secret key plus the current time, and they change every 30 seconds. The same key always produces the same code in any standards-compliant authenticator.
If you have the Base32 secret key the service gave you when you enabled two-factor authentication, paste it into the field above and the code appears immediately. You do not need to install anything.
If the service only ever sends codes to your phone by SMS, there is no secret key to paste — you have to wait for the message. A key is only issued when the service supports authenticator apps.
Nine times out of ten the clock on your device is wrong. TOTP codes are derived from the current time, so a drift of more than about 30 seconds produces codes the service rejects. Turn on automatic date and time, then try again. The other common cause is an incomplete key: Base32 uses only A–Z and 2–7, so if you can see a 0, 1, 8 or 9 you have copied the wrong string.
It is shown once, during setup. When a service displays its QR code there is almost always a smaller link beside it reading "can't scan?" or "enter key manually" — that reveals the Base32 key in text form. If you only scanned the QR code and never saved the text, there is no way to recover it; you have to turn 2FA off and on again to be issued a new key.
Thirty seconds, in the standard configuration. In practice most services also accept the previous code, so you usually have closer to a minute. If the code rolls over while you are typing, just use the new one — there is no penalty for the change.
Yes. The phone is not what makes two-factor authentication work; the secret key is. Any tool that implements RFC 6238 can turn that key into valid codes, which is exactly what this page does. Keep the key itself somewhere safe and you are never locked out by a missing, flat or lost handset.