Free TOTP Authenticator
Generate 2FA codes from a secret key.
What is the TOTP Authenticator?
Two-factor authentication protects your accounts with a rotating 6-digit code — but if your phone is flat, lost, or you just need a code at your desk fast, an authenticator app isn't always to hand. This tool generates the same TOTP code from your secret key, right in the browser.
It runs entirely on your device using the Web Crypto API; your secret is never uploaded or stored.
Last updated: Sep 1, 2026
What does this tool do?
You paste the Base32 secret key shown when you set up 2FA (the string behind the QR code), and the tool computes the current time-based one-time password — a 6-digit code that refreshes every 30 seconds, exactly matching what Google Authenticator, Authy or 1Password would show for the same secret.
A countdown ring shows how long the current code is valid, and one tap copies it.
Key features
Standard TOTP
RFC 6238, 30-second step, 6 digits.
Live refresh
New code every 30 seconds with a countdown.
Copy in one tap
Grab the code without retyping.
Private
Computed locally; the secret never leaves your device.
No app needed
Works in any modern browser.
Example
Common use cases
- Anyone locked out — Get a code when your phone isn't available.
- Developers — Test 2FA flows without an app.
- Desktop users — Copy codes without picking up a phone.
- Backup access — Use a stored secret as a fallback.
- Teams — Generate codes for a shared service secret.
- Learners — See how TOTP actually works.
Benefits
- Matches your authenticator app exactly.
- No install — works in the browser.
- Secret stays on your device.
- Free and instant.
Tips
- Use the secret key (the Base32 string), not the QR image — click 'enter a setup key manually' during 2FA setup to reveal it.
- Only paste your secret on a device and network you trust; anyone with the secret can generate your codes.
- If a code is rejected, your device clock may be off — TOTP depends on accurate time.
- Keep your real authenticator app as the primary; use this as a convenience or fallback.
- Never share the secret key — treat it like the password itself.
Common mistakes to avoid
Pasting the QR URL instead of the key
Fix: Use the Base32 secret (letters A–Z and digits 2–7), not the whole otpauth:// link or image.
Wrong device clock
Fix: TOTP is time-based; if codes fail, correct your device's clock and try again.
Storing the secret carelessly
Fix: The secret is as sensitive as your password — don't save it in plain text or share it.
Assuming it's uploaded
Fix: It isn't — the code is computed locally and nothing is sent or stored.
How it works
- 1
Paste the secret
The Base32 key from your 2FA setup.
- 2
Get your code
A live 6-digit code appears.
- 3
It refreshes
A new code every 30 seconds.
Frequently asked questions
No — the code is generated entirely in your browser using the Web Crypto API. Your secret never leaves your device and isn't stored.
Yes — it implements standard TOTP (RFC 6238) with a 30-second step and 6 digits, so it produces the same codes as Google Authenticator, Authy and similar apps for the same secret.
Treat the secret like a password — anyone who has it can generate your codes. It's processed locally and not stored, but only use it on a device and network you trust.
No — the code is generated in your browser with the Web Crypto API. Your secret never leaves your device and isn't stored.
Yes — it uses standard TOTP (RFC 6238), 30-second step, 6 digits, so it matches Google Authenticator, Authy and similar for the same secret.
Treat it like a password — only use it on a device and network you trust. It's processed locally and not stored.
Yes — free, no sign-up.
Conclusion
Generate the same rotating 2FA code your authenticator app would, straight from the secret key and entirely in your browser. Use the Base32 key, keep your clock accurate, and treat the secret like a password — it never leaves your device.
How-to guides
- How to Set Up Two-Factor Authentication (2FA)Learn how to set up two-factor authentication step by step — choose an authenticator app over SMS, scan the code, and save backup codes so you're never locked out.
- How to Spot a Phishing Email Before You ClickLearn how to spot a phishing email — the sender tricks, fake links, urgency tactics and red flags that reveal a scam before it steals your login or money.
- How to Protect Your Online Accounts From HackersA practical checklist to secure your online accounts: unique passwords, two-factor authentication, spotting phishing, and locking down the email that controls everything.
Related tools
Hash Generator
Create SHA-1, SHA-256, SHA-384 and SHA-512 hashes.
Password Generator
Create strong, random passwords instantly.
Password Strength Checker
Estimate how strong a password is.
Caesar Cipher (ROT13)
Encode and decode text with a shift cipher.