Free tool · runs in your browser
2FA code generator
Paste the 2FA secret for one of your own accounts and get the code it produces right now. Nothing you paste leaves this tab. No account, no cost.
Your code will appear here.
Copy places text on your system clipboard, which other apps can read. Paste it where it belongs, then copy something else.
Where to find the secret
When you turn on two-step verification, the service shows a QR code and, usually behind a link like Can't scan it? or Enter key manually, the same secret as text. That text is what goes in the box.
Secrets use base32: the letters A–Z and digits 2–7. A real secret never contains 0, 1, 8 or 9, so the tool reads 0 as O and 8 as B and tells you when it does. It refuses 1 and 9 rather than guess.
Most services show the secret once. Save it with your recovery codes, in different places.
How the six digits are made
The method is TOTP, the open standard RFC 6238. Your secret and the current 30-second time step go through a one-way HMAC calculation, and six digits come out. The service does the same sum with the same secret, which is why an authenticator app works without signal.
Nothing is encrypted or decrypted, and a code can never be turned back into its secret. Codes keep leading zeros: 042318 is a normal code.
App codes vs SMS codes
| Authenticator code | SMS code | |
|---|---|---|
| Made by | Authenticator codeYour device, from a secret you hold | SMS codeThe service, sent by text |
| Needs | Authenticator codeThe secret and a correct clock | SMS codeA number that can receive it |
| Delivery to intercept | Authenticator codeNone | SMS codeYes |
Where a service only offers SMS, you need a number that can receive it — that's what our US verification numbers are for.
2FA code questions
For your own accounts and your own secrets only. It cannot find, guess or recover a secret, or switch off two-step verification.
Is it safe to paste my 2FA secret here?
The code is calculated in your browser with the standard Web Crypto API. The secret is not sent to a server, not logged, and not written to cookies or local storage. You can confirm this by going offline after the page loads: codes still appear.
Why does the result repeat my secret before the code?
So each code stays attached to the account it belongs to. Paste a secret|code line back in later and the tool reads the part before the bar.
My code was refused. What should I check first?
Your device clock. A code is made from the current time, so a clock that is a minute or more out produces codes services refuse. Turn on automatic date and time, then try a fresh code.
Why does the code change every 30 seconds?
TOTP codes are tied to 30-second steps of a worldwide clock, so they change at :00 and :30 past every minute everywhere at once. Use a code with time left on it.
Can I paste the otpauth:// link from a QR code?
Yes. If the link sets its own digits, period or algorithm, the tool uses them. The line you copy back carries only the bare secret, never the account name in the link.
Can this get my codes back if I lost my phone?
Only if you still have the secret itself. Without it there is nothing to calculate from; use the account's recovery codes or the service's own recovery process.
Does it work with 8-digit codes, 60-second steps or Steam?
8-digit codes and custom steps work when you paste the full otpauth:// link that specifies them. Steam uses its own five-character format, and counter-based (HOTP) codes are not supported.