Online 2FA Authenticator

Use this online 2FA authenticator to turn a setup secret into a current time-based one-time password (TOTP). Paste the Base32 key shown when you enable an authenticator app, or paste a standard otpauth://totp link. The calculation happens on your device and the six- or eight-digit verification code updates when its time window ends.

How to generate a 2FA code

1. On the account you are signing in to, find the text setup key supplied for an authenticator app. If you already have an otpauth:// link, you can use that instead.
2. Paste the secret into the field above. Spaces and hyphens in a Base32 key do not matter.
3. Keep SHA-1, six digits and 30 seconds unless the service specifies different TOTP settings. A provisioning link applies its own algorithm, code length and period automatically.
4. Select Generate 2FA code, copy the current code and enter it on the original service before the timer expires.
5. Use Clear secret as soon as you finish. Closing or leaving the page also removes the active value from the tab.

The secret key is more sensitive than an individual verification code. Anyone who obtains it can create future codes, so do not paste it into a shared computer, chat, form or untrusted website. Keep your original setup secret and recovery codes in an encrypted password manager or another protected location.

What the TOTP generator supports

The generator accepts Base32 characters A–Z and 2–7 and recognizes standard TOTP provisioning links. SHA-1, SHA-256 and SHA-512 HMAC algorithms are supported, along with six- and eight-digit codes and periods from 1 to 300 seconds. The normal combination used by many websites is SHA-1, six digits and a 30-second period.

TOTP is defined in RFC 6238. It combines a shared secret with a counter derived from Unix time. Your browser and the account provider independently perform the same HMAC calculation, which is why matching clocks and settings produce the same short code without either side transmitting the code to the other during generation.

Local processing with no saved secrets

GetMyPassword does not submit the secret or generated code to its server. The tool uses the browser’s Web Crypto API and holds the decoded key only in the memory of this tab while the result is active. It does not write the value to cookies, localStorage, sessionStorage, analytics events or a shareable URL.

This page also applies a restrictive security policy that blocks third-party scripts, frames and connections. The input disables browser autocomplete and common password-manager autofill hooks. When you clear, close or leave the page, the tool overwrites its in-memory byte array and clears the visible field. These controls reduce accidental exposure, but you should still generate a code only on a device and browser profile you trust.

2FA, TOTP and account security

Two-factor authentication asks for two different forms of proof, often a password and something available from a device. TOTP is one way to provide that second factor. Learn more in our guide to two-factor authentication, and use a unique password from the password generator for the first factor.

A TOTP code is short-lived, but it is not phishing-proof. An attacker can relay a fresh code to the real service before it expires. Check the domain carefully and never approve a sign-in you did not start. For high-value accounts, a passkey or hardware security key can provide stronger resistance to credential phishing when the service supports it.

Why a verification code may be rejected

• Clock mismatch: enable automatic date, time and time-zone synchronization on the current device.
• Wrong secret: confirm that the setup key belongs to the exact account you are opening.
• Different parameters: verify the HMAC algorithm, number of digits and refresh period.
• Expired window: wait for the next code if only a few seconds remain before copying it.
• HOTP instead of TOTP: counter-based HOTP tokens cannot be generated by this time-based tool.

Frequently asked questions

Does GetMyPassword save my 2FA secret?

No. The secret exists only in the memory of the current browser tab while the generator is active. It is not sent to GetMyPassword, placed in a URL or written to browser storage.

What format should I paste?

Paste a Base32 authenticator setup key or a standard otpauth://totp URI. Spaces and hyphens in a Base32 key are ignored.

Why does the code change every 30 seconds?

TOTP uses the current Unix time as a moving factor. Thirty seconds is the common default recommended by RFC 6238, although a provisioning link can specify another period.

Why is my 2FA code rejected?

Check the secret, algorithm, code length and device time. A code copied at the end of its window may expire before the server receives it.

Is an online authenticator a replacement for my authenticator app?

It can help with temporary access or testing on a trusted device, but a dedicated authenticator or hardware security key is usually better for routine account protection.

Can a TOTP code stop phishing?

It limits the usefulness of a stolen password, but real-time phishing can relay a valid code. Always confirm the domain before entering credentials.