About
Paste the secret from a two factor setup screen and this produces the same 6 digit code an authenticator app would, refreshed on the standard 30 second window. The secret is used by the page you are looking at and is not sent anywhere.
How to use
One Base32 secret per line, or an otpauth:// link copied from a QR code, or a uid|password|secret triple where only the third field is read. Codes appear immediately and roll over with the clock.
What a TOTP code actually is
The service and you hold the same secret. Both sides run it through a standard function together with the current time rounded to a 30 second slot, and both arrive at the same six digits. Nothing is transmitted to generate a code, which is why an authenticator works on a plane. It also means a code cannot be recovered later: once the slot passes, that number is gone and the next one is unrelated.
What you can paste in
A Base32 secret is the common case, and it survives being pasted with the spaces that setup screens like to add. An otpauth:// link works and carries the account label with it. The uid|password|secret format shows up in exported credential lists, and only the third field is read. Several lines at once produce several codes, which is the reason this exists as a page rather than a single input box.
When the numbers do not line up
Three causes cover nearly everything. Clock drift on the machine is first, and it is fixed by turning on automatic time rather than by re-pasting the secret. A secret copied with an invisible character is second, usually from a PDF or a chat message. Third is a provider that issued something other than a 6 digit, 30 second code, which no generic generator will match.
Use this as a spare, not as your authenticator
A browser tab is a fine way to get into an account when your phone is in another room. It is a poor place to keep the only copy of a secret, because nothing here backs it up, syncs it, or survives a cleared cache. Keep the primary factor in an app you control or on a hardware key, and treat this as the fallback you are glad exists at the wrong moment.
What stays on your machine
The secret and the generated code stay in the page. There is no account, no sync, and no request carrying the secret anywhere. That also removes any recovery path: if you lose the secret, this page cannot help you find it, and the service that issued it is the only one who can.
FAQ
Why does my code differ from the one on my phone?
Almost always the clock. TOTP derives the digits from the current time, so a device running a minute fast produces a different code. Check that the machine's time is synchronised, then check that the secret was pasted without stray spaces.
Can I paste the QR code itself?
Not the image, but the otpauth:// link behind it works. Most setup screens offer a text version next to the QR, and any QR reader will give you the same string.
Does this give me backup codes?
No. Backup codes are issued by the service you are protecting and are unrelated to the shared secret. Save them where the service told you to.
Is it safe to use on a shared computer?
The secret sits in that browser tab while the tab is open, so on a machine you do not control, clear the field and close the tab when you are done. Treat the secret the way you would treat the password itself.
Why 6 digits and 30 seconds?
Those are the defaults nearly every service uses. If a provider issued a secret with a different digit count or period, the codes here will not match theirs.
Related tools
- Security and generator tools
- Random Password Generator
Generate a password in the browser, nothing sent.
- Password Strength Checker
Estimate strength locally, nothing leaves the tab.
- SHA Hash Generator
SHA-1, SHA-256 and SHA-512 digests, computed locally.
- Random String Generator
Random tokens and test data, generated locally.