2FA Code Generator - TOTP Secret & QR Code Online

Loading tool…

Free TOTP & 2FA Code Generator

Time-based one-time passwords (TOTP) are the 6-digit codes shown by apps like Google Authenticator, Authy and 1Password. QodeCat 2FA Code Generator lets you create a fresh secret with a scannable QR code for your own app, or paste an existing Base32 secret to see the code it produces right now.

New secrets: 160-bit random keys from the browser's cryptographic generator.
QR code: a standard otpauth:// URI that any authenticator app can scan.
Live codes: the current code, the next code and a countdown to the refresh.
Options: 6 or 8 digits, 30 or 60 second periods, SHA-1, SHA-256 or SHA-512.

Why use this tool?

Testing your own 2FA

If you are adding two-factor login to an application, you need secrets and QR codes to test with, and a quick way to check that your server accepts the right code. This tool follows RFC 6238 exactly, so its codes match what real authenticator apps show.

Your secret stays private

The HMAC calculation runs locally with the Web Crypto API. Your secret is never uploaded, logged or stored. Still, treat this as a testing and recovery aid, not a replacement for a dedicated authenticator app on your phone.

Frequently Asked Questions

Q. Why does my code not match my authenticator app?

Check that the digits, period and algorithm match the account settings (most services use 6 digits, 30 seconds and SHA-1), and that your device clock is correct. TOTP codes depend on the current time.

Q. What is a Base32 secret?

It is the shared key behind the QR code, written with the letters A-Z and digits 2-7. Services often show it under "can't scan the code?". Spaces and lowercase letters are fine here.

Q. Is it safe to paste my real secret?

Nothing leaves your browser, but anyone who sees your secret can generate your codes. Only paste it on a device you trust, and close the tab when you are done.