Get the current two-factor code from a setup key, without a phone
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.A service showed you a setup key instead of a QR code, or you are testing two-factor login and do not want to reach for your phone every thirty seconds. Paste the Base32 key and the current six-digit code appears with a countdown, plus the codes before and after it.
Copy the setup key the service shows when you choose to enter a key instead of scanning a QR code.
Paste it into the Secret (Base32) or otpauth:// link box, replacing the random secret the page opens with.
Read the six-digit Current code and the ring showing the seconds left.
Click the code, or press Ctrl+Enter, to copy it, and paste it into the login form before the countdown ends.
The key stays in this tab; it is never saved or sent anywhere.
This TOTP generator shows the live one-time code for a secret, with a ring counting down to the next code and the previous and next codes beside it. It builds the otpauth link and QR code that Google Authenticator, Microsoft Authenticator, Authy and password managers scan, and it tests whether a code you type is valid right now.
Developers use it while building two-factor login: generate a secret, scan it into a phone, and check that the server accepts the same codes the page shows. Support teams use the tester to see whether a user's code is simply late, because a code from the previous window means the phone clock is behind. It also reads an otpauth link pasted from a password manager export.
Everything runs in your browser with the Web Crypto API and the page's own clock, so the codes are only as right as your device time. Secrets are never sent, logged or saved; only your period, digits and algorithm are remembered. The QR code is drawn on the page and not fetched from any service.
The rest of the article, and all 6 questions about TOTP Generator and Tester, are on the TOTP Generator and Tester page.
Paste the Base32 secret, the string of letters A to Z and digits 2 to 7 a site shows under its QR code, into the Secret box. The current code appears straight away with a countdown. Spaces and lower case are fine. If you have an otpauth:// link instead, paste that and the settings are filled in from it.
The most common cause is clock drift: codes depend on the time, so a phone or server a minute off produces codes the other side does not expect. Use the tester to see whether the code matches the previous or next window. Other causes are a mistyped secret or an algorithm, digit count or period that differs from the server.
Servers usually accept codes from one step before and after the current one, so a code typed a few seconds late or from a slightly wrong clock still works. The tester lets you allow 0, 1 or 2 steps either side and reports which step matched, which tells you roughly how far off the clock is.
HOTP (RFC 4226) makes a new code each time a counter goes up, usually when a button is pressed. TOTP (RFC 6238) replaces the counter with the current time divided into 30 or 60 second steps, so codes expire on their own. Almost all authenticator apps use TOTP; this tool generates and tests TOTP only.
Still stuck? Ask about TOTP Generator and Tester and anybody who knows can answer. No account needed.
On the related tools: CSP Validator – Find typos, missing semicolons and invalid sources in a Content-Security-Policy · JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember.
In the collection Security Tools for Developers.