Generator/What is 2FA
Two-factor authentication asks for two different kinds of evidence instead of one. A password is something you know, and it can be guessed, reused or stolen in a breach. The second factor is something you have, which an attacker with your password still does not.
Almost every service offers one of three, and they are not equally strong.
TOTP is defined in RFC 6238, and the mechanism is simpler than it looks. At enrollment the service gives you a secret key. From then on, both sides do the same arithmetic: take the current Unix time, divide it into 30-second steps, run the step number and the secret through HMAC-SHA1, and truncate the result to six digits.
Two consequences follow, and they explain most of what confuses people. Nothing is sent when a code is generated — your authenticator never talks to the service, which is why it works on a plane. And the code depends on the clock, so a device more than roughly thirty seconds out of step produces digits the service rejects even though the key is perfectly correct. That is the single most common cause of a code being refused.
You may see HOTP mentioned alongside it. HOTP counts events instead of time: each code advances a counter. It is rare today because the counter drifts out of sync if you generate codes you never use. TOTP replaced it by using the clock as a counter both sides already agree on.
The QR code you scan at enrollment is not magic — it is a text link. Decoded, it reads roughly otpauth://totp/GitHub:[email protected]?secret=JBSWY3DP...&issuer=GitHub. The secret is the shared key, usually 16 or 32 characters drawn from A–Z and 2–7, which is Base32. Everything else in the link is a label or a parameter.
Treat that key the way you would treat a password that can never be changed quietly. Anyone who has it can produce valid codes for the account indefinitely, and rotating it means re-enrolling at the service. It is also why keeping the text key at enrollment matters: a key you hold can be added to a second device later, while a QR code you scanned once and never saved cannot.
Most services hide the text behind a link on the QR screen — “can’t scan the QR code?” or “enter this key manually”. The setup guides name where each one puts it.
Codes defend against a specific thing: someone who has your password. They stop credential stuffing, reused passwords surfacing in a breach, and casual guessing. That is a large share of real-world account takeover, which is why turning 2FA on is worth the friction.
They do not defend against handing the code to the wrong person. A convincing fake login page can ask for your password and your code, then use both on the real site inside the same 30-second window. Nor do they help if malware is already on the device, or if an attacker takes over the account recovery path — an email inbox with no 2FA of its own is often the weakest link in the chain.
The practical response is to protect the recovery path as carefully as the account, keep the recovery codes a service issues at enrollment, and use passkeys where they are offered.
Because TOTP has no registration step, any authenticator holding your key produces the same code. That is what lets Gen2FA generate a working code from a key you paste, with no account and no install — useful at a keyboard, or when the phone with your authenticator is flat, lost or elsewhere.
It is not a replacement for an authenticator app, and this site says so in its disclaimer rather than pretending otherwise. An app is a vault that survives a cleared browser and keeps keys off the machine you browse on. Keep one enrolled. Compare the two approaches on the alternatives pages.