Paste the setup key a site gave you, or scan its QR code. The six digits appear below, worked out in your browser and never sent anywhere.
No accounts here. Add a key and it is saved in this browser.
No key leaves this device. Codes are worked out here and there is no server to send one to. Accounts you add are saved in this browser as readable text, so skip that on a shared computer. Analytics counts page visits only and never sees a key.
On the 2FA screen, choose “authenticator app”, then look for can’t scan the QR code. That reveals the Base32 setup key, usually 16 or 32 characters of A–Z and 2–7.
Spaces and dashes are ignored. Upload the QR image, drop it on the field, or scan it with a camera — the issuer and parameters come straight out of it.
Save the same key in a password manager, and keep the site’s recovery codes offline. A browser tab is a second factor, not a backup plan.
Each guide covers where that service hides the text key, the parameters it issues, and its recovery path.
A 2FA code is not sent to you and not looked up anywhere. It is calculated. At enrollment a service hands you a secret key; from then on both sides take that key and the current 30-second block of time, run them through HMAC, and cut the result down to six digits. Do the same arithmetic with the same key at the same moment and you get the same number, which is why an authenticator works on a plane and why nothing needs to be transmitted.
Two things follow. Your clock matters — drift of more than about thirty seconds produces codes a service rejects from a key that is entirely correct. And nothing registers a device, so several authenticators can hold the same key and all show the same code. That is what lets this page produce a working code with no account and no install.
The longer version, including the three kinds of second factor and what 2FA does not protect against, is in what 2FA is and how it works. The algorithm itself — the counter, the HMAC and the truncation that produce the digits — is in what TOTP stands for and how it works.
This implements RFC 6238, the published TOTP standard, rather than anything tied to one provider. If a service tells you to use an authenticator app, it works here: crypto exchanges, developer platforms, cloud consoles, social accounts, password managers and gaming platforms alike.
SHA-1, SHA-256 and SHA-512 are supported, along with six or eight digits and non-standard periods. Those parameters ride inside an otpauth:// link when you scan a QR code, and can be set by hand under Advanced when a service only gives you the raw key. It matters more than it sounds: Kraken issues SHA-512 and Steam uses a five-character alphabet instead of digits, and an authenticator told the wrong parameters produces codes that never work. The setup guides name what each service actually issues, and the TOTP generator page exposes every parameter on its own, with the RFC 6238 test vectors to check the output against. To confirm a key you have saved still matches the account before you need it, use the 2FA tester.
This was built to solve one specific irritation. The phone with the authenticator on it is usually somewhere else — on charge in another room, or just not on the desk. A site asks for a code, and you get up, unlock the phone, open the app, find the account, and race six digits back to the keyboard before they expire.
The worst case is enabling 2FA in the first place: the setup key is already on the screen in front of you, and you still walk to another room to read a number derived from it. TOTP has no registration step, so any authenticator holding that key produces the same digits — the code never had to come from the phone. The longer version is on the about page.
It is not a replacement for an authenticator app, and this site will not pretend otherwise. An app is a vault: it survives a cleared browser, keeps keys off the machine you browse on, and restores to a new phone. Keep one enrolled, keep your recovery codes, and use this when the app is out of reach. The comparisons set out where each approach wins.
A six-digit number that proves you hold a second factor beyond your password. It is derived from a secret key the service gave you at enrollment and the current time, so it changes every 30 seconds. Both your authenticator and the service compute it independently — nothing is sent between them.
On the service’s two-factor settings, choose to add an authenticator app. A QR code appears, and almost always a link beside it reading "can’t scan the QR code?" or "enter this key manually". That reveals the Base32 text key, usually 16 or 32 characters of A–Z and 2–7. Keep it: a key you hold can be enrolled on another device later.
No. The key stays in the tab and is never transmitted — there is no backend to transmit it to. The page ships a Content-Security-Policy that permits requests only to this origin and to Google Analytics, which measures page visits and never receives a key.
Almost always device clock drift. TOTP derives the code from the current time, so a clock off by more than about 30 seconds produces codes the server will not accept, even from a perfectly correct key. Turn on automatic time sync and try again.
Yes. Code generation itself makes no network requests — once the page has loaded you can disconnect and it keeps producing codes from your device clock. Only the analytics tag needs the network, and it has nothing to do with generating a code.
For reading a code, yes — both implement the same standard, so the digits match for the same key. As a replacement it is not equivalent: an app is a vault that survives a cleared browser and keeps keys off the machine you browse on. Keep an app enrolled and use this when the phone is not in your hand.
Any service that supports a standard authenticator app works, because the tool implements RFC 6238 rather than anything service-specific — crypto exchanges, developer tools, social accounts, cloud consoles and password managers included. A few issue non-standard parameters, such as Kraken using SHA-512, and those are set automatically from an otpauth:// link or by hand under Advanced.
Free, with no account, no sign-up and no install. There is nothing to register because there is no server holding anything about you.