2fakey

Free online authenticator

TOTP 2FA code generator

Paste a Base32 secret, get a live 6-digit code. Optional: save the account in a cookie on this device and generate again anytime.

Letters A–Z and digits 2–7. Spaces are ignored. Generation runs in your browser.

Saved on this device

Accounts are stored in a 2fakey_vault cookie (not on our servers). They work the next time you open this page in the same browser.

No saved accounts yet. Generate a code with “Save this account” checked.

How the generator works

  1. Paste or pick an account

    Use a new Base32 secret or tap a cookie-saved account to fill the form.

  2. Generate in the browser

    2fakey computes the current RFC 6238 TOTP locally. The code updates every 30 seconds.

  3. Copy and sign in

    Copy the 6-digit code before the countdown ends. Saved accounts stay on this device until you remove them.

TOTP verifier

Check whether a code matches a secret within a clock-drift window.

Base32 encoder

Encode or decode RFC 4648 Base32 used by authenticator apps.

Secret generator

Create a random Base32 TOTP secret for new 2FA enrollments.

otpauth URI builder

Build a standard otpauth://totp URI for authenticator apps.

Online authenticator

How an online TOTP tool compares with Google Authenticator.

Frequently asked questions

What is 2fakey?

2fakey is a free online authenticator that turns a Base32 two-factor secret into a live RFC 6238 TOTP code. Codes refresh every 30 seconds, matching Google Authenticator, Authy, and Microsoft Authenticator defaults.

Are my 2FA secrets stored on your servers?

No. Codes are generated in your browser. If you choose Save on this device, the secret is written only to a first-party cookie on your computer or phone so you can generate again later. We do not keep a database of secrets.

Is saving secrets in a cookie safe?

A cookie stays on that browser until you delete it or it expires. Anyone with access to the device can open 2fakey and generate codes. Use it on a device you control, give accounts a label (not the secret), and remove entries you no longer need. For high-value accounts, prefer a dedicated authenticator app or hardware key.

What secret format does 2fakey accept?

Paste the Base32 secret shown when you set up 2FA: letters A–Z and digits 2–7. Spaces, dashes, and padding are ignored.

Do I need to install an app?

No. 2fakey runs in the browser on mobile and desktop. Saved accounts return when you reopen the site in the same browser, as long as cookies are allowed.

Online TOTP authenticator for RFC 6238 codes

Time-based one-time passwords (TOTP) are the 6-digit codes most sites ask for after your password. They come from a shared Base32 secret and the current time, using RFC 6238. 2fakey is a browser authenticator for those secrets: useful when you need a code quickly, are setting up a new app, or want a labeled list on one device.

Default settings match Google Authenticator: SHA-1, 6 digits, 30-second steps. Pair this generator with the TOTP verifier when you are debugging a clock or secret, or the secret generator when you enroll a new service.