Live 2FA codes from a secret key or QR code, Google Authenticator export reader, code checker and test secrets.
Runs in your browserNo sign-up required
or paste a screenshot here (Ctrl+V)
Advanced: digits, period, algorithm
Almost every site uses 6 digits, 30 seconds and SHA-1. Change these only if the site says so.
Enter the secret key from a site's 2FA setup page, or read its QR code, to see the live code. Reading a Google Authenticator "Transfer accounts" QR shows every account in it.
Everything runs in your browser. Secrets are never sent or saved, and they're gone when you close the page. Anyone with a secret can make your codes, so don't share it, and keep your accounts in a proper authenticator app too.
A Testing Tool, Framed Honestly
Developers building or testing a 2FA flow often need to generate a code without reaching for their phone every time. This tool implements the standard TOTP algorithm (the same one behind Google Authenticator and Authy) entirely in your browser — but it's worth being upfront: storing a real account's 2FA secret in any browser tool carries more risk than a dedicated authenticator app or hardware key, so this is best suited for your own test accounts and integrations.
How to Use This Tool
1Add the secretType the key from the site's 2FA setup page (spaces and dashes are fine), paste an otpauth:// link, or upload or paste a screenshot of the 2FA QR code or a Google Authenticator export QR.
2Check the accountFrom a QR code or link, the site name and account are shown, with the digits, period and algorithm filled in.
3Read the live codeThe code refreshes on its own, with a countdown ring. In the last seconds, the next code is shown so you never paste one that's about to expire.
4Copy itTap the code or the Copy button and paste it into the login form.
5Moving to a new phone?Read a Google Authenticator "Transfer accounts" QR code to see every account in it, then show each account's own QR code to scan into another authenticator app.
Good to Know
Use it to check a code, recover codes while moving phones, or test your own 2FA integration. It isn't a replacement for a proper authenticator app or hardware security key.
Codes follow RFC 6238 (TOTP) and RFC 4226 (HOTP), computed with the browser's Web Crypto API, and match the official published test vectors, the same standard every authenticator app uses.
Nothing is transmitted anywhere — the secret and every generated code stay in your browser. That said, storing a real account's 2FA secret in any browser-based tool carries more risk than a dedicated authenticator app.
An otpauth:// URI (the format encoded in a 2FA setup QR code) is parsed automatically, filling in the secret, digit count, period, and algorithm for you.
The tool compares your device clock with our server. If it's off, the codes shown here are corrected and you're told — a wrong clock is the most common reason 2FA codes get rejected.
Frequently Asked Questions
Is it safe to use this for my real accounts' 2FA?
It runs entirely in your browser and transmits nothing, but a dedicated authenticator app or hardware key is still the safer place to store a real account's 2FA secret long-term. This tool is best suited for testing your own 2FA integrations or occasionally checking a code without your phone.
What is a TOTP secret?
It's the shared key generated when you set up two-factor authentication on a service — usually shown as a QR code (which encodes an otpauth:// URI) or a short Base32 text string you can type manually.
Why does the code change every 30 seconds?
TOTP combines the secret key with the current time, rounded down to a fixed interval (30 seconds by default), so both your device and the service can independently compute the same code without ever transmitting it.
Why does a site say my 2FA code is wrong?
Usually the device clock is off by more than about 30 seconds, so the device and the site calculate different codes. This tool checks your clock against our server, corrects the codes, and tells you how far off it is — turn on automatic date and time to fix your authenticator app too. The other common cause is a code that changed just as you submitted it; use the "Next code" shown in the last few seconds.
Can I read a 2FA QR code here?
Yes. Tap "Read a QR code image" and choose a screenshot or photo of the setup QR code, or paste a screenshot directly. The QR is decoded in your browser, and the secret is hidden on screen once it's read.
How do I move Google Authenticator accounts to another app?
In Google Authenticator, open the menu, choose "Transfer accounts", then "Export accounts", and take a screenshot of the QR code. Read that screenshot here: every account in it is listed with its live code. Tap "Move to another app" on an account to show its own QR code, and scan it with the new app (Microsoft Authenticator, Authy, 2FAS, Bitwarden and others). Large exports are split into several QR codes; read each one.
How can I check why a site rejects my 2FA code?
Open "Check a code", enter the secret and the code your app shows. You will see whether it is the current code, an old one, one from a device with a fast clock, or not valid for that secret at all, which tells you whether to fix the clock or set up 2FA again.
Can I create a 2FA secret for testing?
Yes. "Create test secret" makes a random 160-bit secret with a QR code and otpauth link for any app name, so developers can test a 2FA login. For a real account, always let the website create the secret.
Does this work with Google Authenticator-style secrets?
Yes — TOTP is a standard algorithm used by Google Authenticator, Authy, and virtually every 2FA implementation that shows a QR code with a rotating 6-digit code.
