UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free 2FA code generator does
Two-factor authentication adds a second step to a login: after your password, you type a short code that changes every 30 seconds. Those codes come from an app on your phone, and they are made from a secret key that you and the service share. This free online 2FA code generator does the same job in your browser. Paste the secret or the setup link, and it shows the current code, the next code and how many seconds are left.
It also helps you to check a code from your own app, find clock problems, make a new random secret, build the setup link and draw a QR code that an authenticator app can scan. It supports SHA-1, SHA-256 and SHA-512, 6 to 8 digits and 15, 30 or 60-second periods, so it works with nearly every service.
How to use the 2FA code generator
- Paste your secret. Use the Base32 text the service shows during setup, or a full otpauth:// link. Spaces are fine.
- Read the code. The big number is the current code. Press it to copy.
- Watch the bar. When it runs out, a new code starts. The next code is shown ahead of time.
- Check an app code. Enter the code your authenticator shows, and the tool tells you whether it matches.
- Set up a new key. Make a random secret, scan the QR code with an app and enter a code on the service to finish.
How time-based codes work
During setup, a service creates a random secret and shares it with you, usually as a QR code. Your authenticator stores it. Every 30 seconds both sides compute HMAC(secret, time ÷ 30), take a piece of the result called the dynamic truncation, and turn it into six digits. Because the secret and the clock are the same, the codes match. The secret never needs to be sent again, and an old code is useless once its window passes.
The algorithm is defined in RFC 4226 for counters and RFC 6238 for time. This tool follows both and matches the published test values.
| Setting | Usual value | Meaning |
|---|---|---|
| Algorithm | SHA-1 | The hash inside HMAC |
| Digits | 6 | Length of the code |
| Period | 30 seconds | How long a code is valid |
Why a code is rejected
- Clock drift. A device clock that is off by a minute or more produces codes the server will not accept. Turn on automatic time.
- Wrong secret. One mistyped character gives completely different codes. The secret uses the letters A to Z and the numbers 2 to 7 only.
- Different settings. Some services use 8 digits, SHA-256 or a 60-second period.
- Reused code. Many services reject a code that was already used.
- Typing too late. If the bar is nearly empty, wait for the next code.
The check box shows if your code matches a nearby step, which is the sign of clock drift, and the time offset setting lets you correct for it.
Keeping your two-factor codes safe
The secret key is as valuable as a password, because it makes every future code. Store it in a password manager or in the secure storage of an authenticator app, never in a note called 2FA. Keep the backup codes that services give you in a separate safe place, since they let you in when your phone is lost. Avoid sharing a screenshot of the QR code. Where possible choose an app or a hardware key over text message codes, which can be intercepted through SIM swapping.
For developers and testers
Developers can use the tool to test sign-in flows and to create test secrets. The RFC example button loads the standard 20-byte secret 12345678901234567890 in Base32 at time 59 with 8 digits, which must give 94287082. The fixed time box lets you reproduce any moment, and the verify box shows how a server with a one-step window would react. For production code use a vetted library, store secrets encrypted, limit attempts and never log codes.
What two-factor codes do not protect against
Time-based codes stop password-only attacks, but a fake login page can ask for the code and use it at once, which is called a real-time phishing attack. Hardware keys and passkeys resist that. Codes also do not help if malware controls your device. Treat two-factor authentication as a strong layer, not the only one, and keep your software up to date.
Setting up two-factor authentication step by step
- Open the security settings of your account and choose an authenticator app as the second step.
- The service shows a QR code and a text secret. Scan the code with an authenticator app, or paste the text secret into this tool.
- Enter the six-digit code to prove it works.
- Save the backup codes in a safe place. They let you in if the phone is lost.
- Record the secret in a password manager that you trust, so you can restore the codes on a new device.
If a service offers a hardware security key or a passkey, those resist phishing better than codes and are worth adding as well.
Planning for a lost phone
The most common two-factor problem is not an attack but a lost or replaced phone. Before it happens, keep at least one recovery path for each important account: the backup codes, a second authenticator that holds the same secret, a hardware key or a recovery email address that has its own protection. Some authenticator apps back up their accounts to the cloud, which helps convenience but adds a place to protect with a strong password. Test your recovery path once, since a method you have never used may not work when you need it. Remove the secret from any place that you do not control once you have stored it safely.
Privacy, limits and responsible use
The secret, the settings and the codes are used only in this page and are not sent or saved. The printed and downloaded summaries hide the secret. Use the tool for your own accounts and for testing. Do not use it to access an account that is not yours.
Frequently asked questions
What is a 2FA code generator?
It creates the 6-digit time-based codes used for two-factor authentication. The codes come from a secret key and the current time, the same way an authenticator app makes them.
How do I use this tool?
Paste the Base32 secret key, or a full otpauth:// setup link, and the current code appears. A bar shows how long it stays valid.
Where do I find my secret key?
Services show it as text next to the QR code when you set up two-factor authentication, often under a link such as Can't scan the code. Save it somewhere safe when you set up.
Is it safe to enter my secret here?
The secret stays in your browser and is not uploaded or saved. Even so, treat it like a password and use a trusted authenticator app for important accounts.
What is TOTP?
Time-based One-Time Password, defined in RFC 6238. It turns a shared secret and the current 30-second window into a short code.
Why is my code not accepted?
Common causes are a wrong secret, a device clock that is off, the wrong algorithm, digits or period, or typing the code just as it changes. Use the check box and the time offset to find the cause.
What if my clock is wrong?
Services accept small drift, but a clock off by a minute or more fails. Fix the device time automatically, or use the offset to line up with the server.
What are the algorithm, digits and period options?
Most services use SHA-1, 6 digits and 30 seconds. Change them only if the service or the setup link says so.
Can I generate a new secret?
Yes. The random secret button makes a 160-bit key. Add the same key to the service and to your authenticator, and keep a copy in a safe place.
What is the QR code for?
It holds the setup link, so an authenticator app can add the account by scanning instead of typing the secret.
Can I move codes to a new phone?
Yes, if you kept the secret key or the QR code from setup. Otherwise use the service's backup codes or recovery process.
Does this replace an authenticator app?
No. A dedicated app keeps secrets in secure device storage. This tool is for testing, learning, development and recovering your own codes.
How does the check box work?
Enter the code from your app. The tool tells you if it matches now, or if it matches one step before or after, which points to clock drift.
What is the RFC test example?
It loads the sample secret and time from the standard, so you can see that this tool gives the published answer of 94287082.
Is two-factor authentication really necessary?
It is one of the best protections available. It stops most account takeovers even when a password leaks. App codes are safer than text messages.
What does the print option include?
A settings summary with a masked secret. It never includes the full secret, the setup link or the live code.
Is it free?
Yes. It is free to use online with no sign-up.
Sources and further reading
- RFC 6238, TOTP: Time-Based One-Time Password Algorithm, and RFC 4226, HOTP (rfc-editor.org).
- RFC 4648, Base 16, Base 32 and Base 64 encodings, for the secret format.
- Google Authenticator key URI format, otpauth:// documentation.
- NIST SP 800-63B, Digital Identity Guidelines, for authenticator guidance (nist.gov).
- CISA, Implementing phishing-resistant MFA (cisa.gov).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.