Generate live 2FA codes and a scannable QR code from any Base32 secret. Works with Google Authenticator, Authy, Microsoft Authenticator, and every RFC 6238 app.
This tool turns a Base32 secret into a live RFC 6238 time-based one-time password (TOTP) — the same rotating six-digit code your authenticator app shows — and renders a scannable otpauth:// QR code so any app can enroll the account in seconds.
It computes codes the moment you paste a secret, ticks them over every 30 (or 60) seconds, and shows the next code due. People use it to:
Everything runs locally in your browser using the Web Crypto API — your secret, the QR image, and every computed code never leave your device, and the page keeps working with the network off.
2FA (two-factor authentication) adds a second proof of identity beyond your password. TOTP — time-based one-time password, defined in RFC 6238 — is the most common form: a short code derived from a shared secret and the current time that changes every 30 seconds, so even a stolen code is useless moments later.
TOTP combines the secret with a counter that ticks once per period — 30 seconds by default. Each period produces a different code, and this page's timer bar shows how many seconds remain before the next one. The short window is what keeps a captured code from being replayed later.
The secret key is a shared Base32 string the service gives you when you enable 2FA. Both the service and your authenticator hold the same secret and combine it with the time to compute identical codes. Base32 uses only uppercase A–Z and digits 2–7 (no 0, 1, 8, or 9). Keep it private — anyone with the secret can generate your codes.
The QR encodes a standard otpauth://totp/... URI containing the secret, account, issuer, digits, and period. Open your authenticator's "add account" or "scan QR" option and point it at the code, and the account is enrolled instantly — no manual typing. You can also use Copy URI to paste the link yourself.
Because the code is derived from the current time, your device clock must be within roughly 30 seconds of the server's, or the codes won't match. Enable automatic (network) time sync on your phone or computer to stay aligned — clock drift is the single most common reason a code is rejected.
Any RFC 6238-compliant app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, Duo, Aegis, Raivo, and dozens more. The QR code uses the standard otpauth://totp/... URI format that every major app understands.
No. The Base32 secret, the QR code image, and every computed code are generated locally using your browser's Web Crypto API and stay in your browser. After the page loads the tool works fully offline — there is no upload, no analytics event, and no log of your secret.