More
More
2FA Code Generator
Time-based one-time codes from a setup key.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
For testing and recovery only. A 2FA setup key is as sensitive as a password: anyone who has it can make your codes. Never paste a real key into a site you do not trust. This page computes the codes in your browser and sends nothing, but the safest home for a real key is an authenticator app or a password manager.
- Previous code
- Next code
- Time step
Test at a fixed time
Useful to check a server, or to compare with the RFC 6238 test values. Leave it empty to follow the clock.
Codes follow RFC 6238 (TOTP) and RFC 4226 (HOTP) and are computed with your browser's Web Crypto HMAC, the same way Google Authenticator, Microsoft Authenticator, Authy and 1Password do. If the codes here do not match your app, check the time on your device first: TOTP codes depend on an accurate clock.
How to use it
- Paste the setup key a site showed you, or the otpauth:// link inside its QR code. Most sites use Base32, six digits, 30 seconds and SHA-1.
- Read the current code. The ring shows how long it stays valid; the next code is listed below it.
- Copy the code. To test a server, open Test at a fixed time and enter a Unix time.
Questions
When is this useful?
When you build or test a login system and need codes to check against, when you want to confirm a setup key you saved is still right before you rely on it, or when an authenticator app shows codes a site rejects and you want to rule out a wrong setting.
Why does the site reject my code?
Usually the clock: if your device is more than about 30 seconds out, codes will not match. Turn on automatic time in your settings. Otherwise check the digits, period and algorithm, which some services change from the defaults.
What is an otpauth link?
The text inside a 2FA QR code. It names the account and issuer and carries the secret, and sometimes the algorithm, digits and period. Paste it here and the settings fill in for you.
Is it safe to keep backup codes and keys?
Yes, if they are stored safely, such as in a password manager or printed and locked away. Losing your phone without them can lock you out of an account for good.
About this tool
About the 2FA code generator
Two-step sign-in apps show a six digit code that changes every 30 seconds. The code is worked out from a secret setup key and the current time, using the open TOTP standard. This tool performs the same calculation, so it shows the same codes your authenticator app would.
When it is useful
- Building or testing a login system and needing codes to check against.
- Confirming that a setup key you saved as a backup is still correct, before you rely on it.
- Working out why an authenticator app's codes are being rejected.
How to use it
Paste the setup key a site showed you, usually Base32 text, or the otpauth:// link stored inside its QR code; the link fills in the settings for you. The ring shows how long the current code stays valid and the next code is listed beneath it. Developers can also test a fixed Unix time, or use counter-based HOTP codes.
If codes do not match
Check the clock first. TOTP depends on accurate time, and a device more than about 30 seconds out will produce codes a site rejects. Turning on automatic time usually fixes it. Otherwise check the digits, period and algorithm.
Keys and codes are computed with your browser's Web Crypto engine and never leave your device. Treat a setup key like a password.
Related tools
- Password GeneratorStrong random passwords, passphrases and custom random strings, made on your device.
- Hash Generator & File ChecksumSHA and MD5 hashes of text or files, HMAC signatures, and checking a download against its published checksum.
- QR Code GeneratorQR codes for links, Wi-Fi and contacts, as PNG or SVG, with a transparent option.
- Unix Timestamp ConverterTimestamps to dates and back, in any time zone.