TOTP 2FA Generator
Generate TOTP 2FA codes and QR codes for authenticator apps. Free, private, 100% client-side using Web Crypto API. Supports otpauth:// URIs and multiple accounts.
Loading tool...
What is TOTP 2FA Generator?
A browser-based TOTP (Time-based One-Time Password) generator that creates 2FA codes using the Web Crypto API. Add accounts, generate QR codes for authenticator apps, and manage multiple 2FA accounts — all without sending data to any server.
Key Benefits
- True cryptographic randomness via Web Crypto API (HMAC-SHA1)
- RFC 6238 compliant — works with Google Authenticator, Authy, etc.
- Generate QR codes for easy mobile app setup
- Import accounts via otpauth:// URI or JSON backup
- Multiple account management with live countdown timer
- 100% client-side — secrets never leave your browser
Common Use Cases
- •Replace mobile authenticator apps with a browser alternative
- •Set up 2FA for GitHub, AWS, Google, and other services
- •Backup and restore 2FA accounts across devices
- •Generate QR codes for mobile authenticator scanning
- •Test and debug TOTP implementations during development
How to Use the TOTP 2FA Generator
- Add an account: Enter the issuer (e.g., Google), account name, and base32 secret key. Or import an otpauth:// URI.
- View your code: A 6-digit TOTP code appears automatically and refreshes every 30 seconds.
- Show QR code: Click the QR icon to display a scannable code for Google Authenticator, Authy, or any TOTP app.
- Copy and use: Click the code to copy it. Paste it into your 2FA login prompt.
- Backup accounts: Export your accounts as JSON for safekeeping. Import them on another device.
Key Features
- RFC 6238 TOTP algorithm with HMAC-SHA1
- Web Crypto API for cryptographic security
- QR code generation for authenticator apps
- Multiple account management
- Import via otpauth:// URI
- Backup export/import as JSON
- Live countdown timer (30-second window)
- 100% client-side — secrets never leave browser
Frequently Asked Questions
Is this tool secure?
Yes. All cryptographic operations use the Web Crypto API (HMAC-SHA1), which is the same standard used by Google Authenticator. Your secrets are stored in localStorage and never transmitted.
Can I use this with Google Authenticator?
Yes! The tool generates otpauth:// URIs as QR codes that are fully compatible with Google Authenticator, Authy, Microsoft Authenticator, and any RFC 6238-compliant app.
Where are my secrets stored?
Secrets are stored in your browser's localStorage. They are never sent to any server. Clearing your browser data will remove all accounts — make sure to export a backup.
What is a base32 secret?
A base32 secret is a string using characters A-Z and 2-7. It is the standard format used by TOTP systems. You typically get this when enabling 2FA on a service.
Can I import from an otpauth:// URI?
Yes. Click "Import URI" and paste the otpauth:// URI. The tool will automatically extract the account name, issuer, and secret.