Paste your secret key or scan a QR code and get your 6-digit 2FA authentication code instantly. Use 2FA online for free, with no sign-up. Your code is generated right in your browser.
otpauth:// link.2FA authentication, short for two-factor authentication (you will also see it written as 2 factor authentication), puts a second check on top of your password. Even if someone learns your password, they still can't sign in without the second factor: a short one-time code that only you can produce.
Most websites use time-based one-time passwords (TOTP), and a TOTP generator like this page creates them from your secret key. Your account and your authenticator share a secret key. Every 30 seconds, both sides mix that key with the current time and land on the same 6-digit code. Think of each code as a temporary 2FA token: it proves you hold the key, then expires, so a stolen code is useless a moment later.
These 2FA codes can come from an app on your phone or from 2FA online tools like this page. Either way the maths is the same, so the codes match.
The same steps work for Google, Facebook, GitHub, Discord and any service that supports standard authenticator apps. Managing several accounts? Save each one with a name so your 2FA codes are always one click away.
Codes are calculated in your browser with the Web Crypto API, and your secret key is not sent to any server. If you choose Save Account, the key is kept in this browser's local storage as plain text, so only do that on a device you trust and never on a shared computer.
Treat a secret key like a password: anyone who has it can generate your codes. Use the tool only for your own accounts, and keep your backup codes and keys somewhere safe, such as a password manager.
To set up an authenticator, open the security settings for the account you want to protect and enable two-factor authentication. Choose an authenticator app or authentication method when the service offers it. The service will usually display a QR code and may also provide a setup key for manual entry.
Only finish setup after the service confirms that the code is valid. Keep the secret key private: anyone who obtains it may be able to generate codes for that account.
If a website rejects your authenticator code, check the following before trying again:
Repeated failures can trigger temporary security limits. If the code still does not work, use the service's official account-recovery process rather than sharing your secret key with someone offering help.
A secret key lets an authenticator generate codes for a specific account, but it is not the same as a recovery code. If you lose the key and still have access to the account, open the account's official security settings and follow its instructions to replace or reset the authenticator method. You may need to verify your identity first.
Never send your secret key or backup codes to another person. If you think someone else has obtained your key, use the account provider's official security settings to replace the authenticator setup as soon as possible.
2FA auth is the everyday short form of two-factor authentication: a password plus a second proof, such as a one-time code. These short answers cover the questions people ask most often.
A 2FA code, also called an authenticator code or verification code, is the 6-digit number that proves it is really you after you enter your password. It is created from a secret key and the current time, so it changes every 30 seconds and works only once.
Turn on two-factor authentication in the account you want to protect and choose the authenticator option. The site shows a QR code and a text secret key. Add either one to an authenticator, and you can generate a fresh code whenever you sign in. The QR code and the key hold the same information, so scan or paste, whichever is easier.
A 2FA app on your phone and an online authenticator do the same job: they turn your secret key into a code. An online 2FA auth tool like this one works in any browser, which helps on a desktop or when your phone is not with you. The trade-off is that you need to protect the device and browser you use it on.
For a Google 2FA code, open your Google Account, go to Security, then 2-Step Verification, and add an authenticator. For Facebook, open Accounts Center, choose Password and security, then Two-factor authentication, and pick the authentication app. Menu names can change, but both show a setup key you can paste above.
Keep your backup codes somewhere safe, never share your secret key, and use a password manager. Where a site allows it, prefer an authenticator code over SMS, since text messages can be intercepted or redirected through SIM swapping. Good 2FA auth starts with a strong, unique password.
Two-factor authentication asks for exactly two proofs. Multi-factor authentication (MFA) is the wider term for two or more. Two-step verification is simply the name some services use, such as Google. For an authenticator code, all of them work the same way.
This website (2faauth.us) is an independent project that offers a free, browser-based TOTP generator. Its codes follow the open standard RFC 6238 (built on RFC 4226), and the generator has been checked against the test values published in that specification.
This guide was last reviewed in October 2026. Setup steps for services such as Google and Facebook can change, so check the service's own help page if a menu looks different. We are not affiliated with Google, Meta, Microsoft or Authy. Found a mistake? Write to [email protected].
It is the 6-digit code your authenticator shows. It is built from your secret key and the current time, and it changes every 30 seconds.
Yes. Any service that accepts standard authenticator apps also accepts codes from this page, because both use the same TOTP method.
Turning on two-factor authentication is free on most major services, and this online tool is free to use too.
It appears during setup, right under the QR code. Look for "Can't scan?", "Enter key manually" or "Setup key". It is a string of letters A-Z and digits 2-7.
Paste the key above and compare the 6-digit code with the one in your authenticator. They should match as long as your device clock is correct.
Codes depend on time, so first make sure your computer's clock is set to update automatically. Then wait for a fresh code, type it before the timer ends, and double-check the secret key for typos.
In Facebook's security settings choose the authenticator app method, then select the option to enter the key manually. Paste that key here and use the 6-digit code to finish setup.
It uses the same standard TOTP method, so the same secret key gives the same codes. This site is not made by or affiliated with Google.
An SMS code is sent to your phone number and can be intercepted. An authenticator code is generated on your device from a secret key, so it needs no mobile signal.
No. Every account has its own secret key and makes its own codes. Save each account with a name so you can tell them apart.
Once the page has loaded, pasting a key and generating codes needs no internet connection. Scanning a QR image uses a small helper that loads online, so reload while connected if scanning fails.
Use your backup codes or the account recovery option to sign in, then set up two-factor authentication again with a new secret key. If you saved your original secret key safely, you can add it to any authenticator.