TOTP Authenticator Codes
Turn a two-factor secret into the six-digit code a site is asking for. Calculated in your browser and never stored.
The text version of the QR code your site showed when you set up two-factor authentication. Spaces are ignored.
Your current code
••• •••
Paste a key to see your code
Codes are calculated in your browser from the key and your clock. Nothing is sent anywhere and nothing is saved between visits — keep your phone app as the everyday method, since a separate device is what makes two-factor authentication work.
How to generate a 2FA code
Two-factor codes are calculated from a secret key and the current time, which is why they change every thirty seconds and why they work without an internet connection. This TOTP authenticator does that calculation in your browser.
- 1
Find your secret key
When a site sets up two-factor authentication it shows a QR code, with a link revealing the key as text for people who cannot scan it. That string is what you need.
- 2
Paste it in
The current code appears immediately, along with a countdown showing how long it remains valid.
- 3
Use it before it expires
Copy the code into the site that asked for it. A new one is generated automatically every thirty seconds.
When this comes in useful
A stopgap instead of a replacement for an app on your phone.
Phone out of reach
Get into an account when your phone is flat, lost or somewhere else.
Testing a setup
Check that a newly configured two-factor secret produces working codes.
Development work
Generate codes against a test account without configuring a phone app for it.
Shared team accounts
Let whoever holds the key produce a code when the account is not tied to one person.
Migrating apps
Verify a key still works while moving between authenticator applications.
Understanding TOTP
See how a secret and a clock combine to produce the codes you type every day.
When an app stops working
Authenticator app not working is usually a clock problem, and generating a code here with a known-good clock tells you which side is wrong.
Recovering from a lost phone
If you kept the secret key, you can produce codes here while you set up a new device.
What an authenticator app actually does
The mechanism is simpler than most people expect, and understanding it explains every strange thing about two-factor codes: why they expire, why they work on a plane, and why a wrong clock breaks everything.
What is an authenticator app
An app that produces a six-digit code, changing every thirty seconds, as a second step when you log in. Because the code comes from a secret held on your device instead of a text message, it cannot be intercepted by SIM swapping, which is the main way phone-based two-factor gets defeated.
The question gets asked constantly in slightly different forms. What is an authenticator app, what is authenticator app, what is the authenticator app, and how to use authenticator app once someone has one. The answer is the same: a small calculator that turns a shared secret and the current time into a number both ends can agree on.
What TOTP means
Time-based One-Time Password. When you scan the setup QR code, your device and the website store the same secret key. Neither ever sends it again.
To produce a code, both sides take the current time, divide it into thirty-second blocks, and run that block number together with the secret through a one-way hash. The last few digits become your six-digit code. Both sides do the same sum and get the same answer without exchanging anything.
That is why a TOTP authenticator works with no signal at all. It is not receiving anything, it is calculating.
Why the clock matters so much
Everything rests on both sides agreeing what time it is. If your device clock has drifted by more than about thirty seconds, you are calculating from a different block number and every code you produce will be rejected.
Authenticator app not working is by far the most common complaint in this area, and a wrong clock is the usual cause. Turning on automatic time sync fixes it more often than reinstalling anything. Most servers accept a code from one block either side to absorb small drift, which is why a code sometimes still works a few seconds after it expires.
Moving to a new phone
This is where people get caught out. Transfer authenticator to new phone is a top search because the original Google Authenticator had no backup at all, so a lost phone meant losing every account at once.
Modern apps handle it better. Google Authenticator now offers account sync, and most alternatives support encrypted exports. Do the transfer before wiping the old device, and keep the recovery codes each site gave you as a fallback that does not depend on any app.
Which app to use
Authenticator apps are interchangeable: any TOTP app works with any TOTP site, because the algorithm is a published standard instead of a product. The best authenticator app is therefore whichever one you will actually keep backed up.
Beyond Google’s, the well-regarded options include Ente Authenticator and Proton Authenticator, both open source with encrypted sync, Bitwarden Authenticator if your passwords already live there, and Yubico Authenticator if you want the secrets held on a hardware key instead of a phone. A free authenticator app is the norm here, so paying is rarely the differentiator.
An authenticator extension, or an authenticator Chrome extension, keeps codes in the browser. Convenient, though it puts both factors on one device, which weakens the point of having two.
Where this tool fits
It is a calculator, not a vault. Nothing is stored between visits, so it cannot replace an app that holds your keys safely.
Use it to test a new secret, to get into an account when your phone is not with you, or to understand what a 2FA authenticator is doing behind the six digits. For everyday logins, keep the secret on a separate device where it belongs.
Using this safely
Two-factor authentication works because the second factor lives somewhere separate. Keep that in mind.
- Keep your phone app as the everyday method. Its whole value is being a separate device from the one you log in with.
- Never paste a secret key into a shared or public computer, since anyone with access could generate codes indefinitely.
- Check your clock if a code is rejected. TOTP depends on accurate time, and a drifting clock produces codes that never match.
- Store your keys in a password manager, not in a note or an email to yourself.
- Save your backup codes when you enable two-factor authentication. They are the reliable way back in if you lose access.
- Nothing is kept here between visits, so a key has to be pasted in each time. That is deliberate.
Questions, answered
How TOTP codes work and when to use this instead of an app.
An app that generates a short code, changing every 30 seconds, as a second step when you log in. Because the code comes from a secret held on your device instead of a text message, it cannot be intercepted by SIM swapping.
Related tools
Other things you can do here without signing up.