Tools / 2FA generator
2FA code generator
Paste the string of capitals and digits from your credentials to get the current 6-digit code. The secret stays in your browser.
🔒 The secret stays in your browser and is never sent to us or any server. Disconnect from the internet and it still works.
What that string actually is
A field like JBSWY3DPEHPK3PXP is not a verification code. It is a TOTP secret — a seed. The secret never changes; the code is computed every 30 seconds from the secret plus the current time. This is the single largest source of support tickets in this business.
Full explanation and common mistakes: how to use a 2FA secret
FAQ
What is the difference between a 2FA secret and a code?
The secret is a long string of capitals and digits that never changes. The code is 6 digits that changes every 30 seconds. Your credentials contain the secret; you use it to compute codes.
Could this tool steal my secret?
No, and you can verify that yourself: disconnect from the internet and this page still produces codes. Everything runs in your browser via Web Crypto — the secret never leaves the device.
The code keeps being rejected.
Nine times out of ten your device clock is off. TOTP depends entirely on time; more than about 30 seconds of drift breaks every code. Enable automatic time sync and retry.
Can this replace an authenticator app?
Not recommended. This is for confirming a freshly delivered secret is valid. For ongoing use, put it in an authenticator app — otherwise you re-paste the secret every time, and every paste is another chance to leak it.
It says my secret is invalid.
Base32 uses only A–Z and 2–7 — no 0, 1, 8 or 9. If your string contains those digits it is probably not the 2FA secret but another field, such as an account ID.