2FA Code Generator (TOTP)
Create a new authenticator secret with a scannable QR code, or paste an existing secret to see its live 6-digit codes. Codes are computed in your browser.
Scan the QR with Google Authenticator, Authy, 1Password or any TOTP app. Building a website? Use our free 2FA API.
Why the Code Changes Every 30 Seconds
The magic is that your phone and the server never talk to each other to agree on a code. They both already share two things: the secret (set when you scanned the QR) and the current time. TOTP just combines them:
- Take the Unix time and divide by 30 - That's the current "time step."
- Run HMAC-SHA1 over that number using the secret as the key.
- Truncate the result to 6 digits. Both sides compute the identical value.
Because the time step advances every 30 seconds, so does the code - And an old code is worthless the moment its window closes. This is also why authenticator apps beg you to keep your phone's clock accurate: if the clocks drift too far apart, the two sides compute different codes. Servers usually accept the adjacent window to forgive a few seconds of skew.
One consequence worth understanding: a stolen 6-digit code is nearly useless (it dies in under a minute), but a stolen secret lets an attacker generate valid codes forever. Guard the secret like a password; the codes protect themselves.
About TOTP Two-Factor Codes
How the 6 digits are made
TOTP (RFC 6238) combines your secret key with the current 30-second time window using HMAC-SHA1, then truncates the result to 6 digits. Because both your phone and the server know the secret and the time, they compute the same code - no network needed. That's why authenticator apps work in airplane mode.
This page runs the same algorithm with the Web Crypto API, entirely locally. Learn more in the complete 2FA guide and TOTP vs SMS.
Keep secrets secret
- Treat the base32 secret like a password - Anyone holding it can generate your codes.
- Save backup codes (or the secret itself) in an encrypted vault like the Password Wallet.
- 2FA protects you even if your password leaks - Enable it on email first, since email resets everything else.
- Never enter TOTP codes on a page reached from an email link - See the phishing guide.
How to Use the 2FA Code Generator
Generate or paste a secret
New secrets are 32 random base32 characters; or paste an existing secret to recover its codes.
Set issuer and account
These label the entry inside authenticator apps so users know which site it belongs to.
Scan the QR code
Google Authenticator, Authy, 1Password and every RFC 6238 app understand this format.
Verify a code
Type the current 6-digit code into the enrolling website - Or use our free 2FA API to verify it programmatically.
TOTP parameters used here (and by virtually every service)
| Parameter | Value | Why |
|---|---|---|
| Algorithm | HMAC-SHA1 | The RFC 6238 default every authenticator app supports |
| Digits | 6 | Standard balance of security and typability |
| Period | 30 seconds | Universal default - Codes rotate twice a minute |
| Secret length | 32 base32 chars (160 bits) | Full HMAC-SHA1 key strength |
| Verify window | ±1 period | Tolerates clock drift between devices |
2FA Code Generator - FAQ
Do TOTP codes need an internet connection?
Is SHA-1 in TOTP a security problem?
What happens if someone sees one of my codes?
Can I use this to add 2FA to my own website?
More questions about passwords and security? Browse the security guides.
More Free Tools
Password Generator →Password Strength Checker
Entropy, crack-time estimates and pattern warnings - All offline.
Password Breach Check
See if a password appears in known data breaches - Privately, via k-anonymity.
Password Generator
Random passwords with full control over length and characters.
Passphrase Generator
Memorable multi-word passphrases (Diceware style).
PIN Generator
Random 4–12 digit PIN codes with no weak patterns.
Username Generator
Random, non-identifying usernames for new accounts.