About the 2FA Authenticator
Turn an otpauth:// URI or a Base32 secret key into live two-factor codes. Each account shows its current time-based one-time password (TOTP, RFC 6238) with a countdown to the next one, and a click copies it. Accounts are saved in your browser so the codes are there when you come back, and every code is computed locally with the Web Crypto API — there is no server behind this tool to send a secret to.
How to use the 2FA Authenticator
-
Add an account
Paste the otpauth:// URI from your password manager or from the service you are enrolling with. Several URIs can be pasted at once, one per line. If you only have the secret key, switch to manual entry and type the service name and the key.
-
Read the current code
Each account shows its code and the seconds left before it rotates. The bar turns red for the last five seconds, when it is safer to wait for the next code than to race the current one.
-
Copy it, and keep a backup
Click a code to copy it. Use Export to download your accounts as otpauth:// URIs so you can restore them here or import them into another authenticator.
When to use it
Testing a 2FA login flow
Generate codes for staging and test accounts on the machine you are developing on, instead of enrolling a phone for every environment.
Checking a provisioning URI
When you implement TOTP in your own application, paste the otpauth:// URI it produces and confirm the algorithm, digits and period yield the codes your server expects.
Codes on a desktop browser
Keep the codes for low-risk accounts one tab away on a computer you trust, rather than reaching for a phone each time.
Frequently asked questions
Are my secret keys sent to a server?
No. The tool has no server component. Secrets are read from the text you paste, saved to localStorage in this browser, and turned into codes with the Web Crypto API on your device. The area showing your accounts is also excluded from the site analytics and session recording.
How are the secrets stored, and is that safe?
They are stored unencrypted in this browser's localStorage. Anyone who can use this browser profile, and any malicious extension that can read the page, can read them. Keeping a second factor in the same browser where you type the password also weakens it as a second factor. For accounts that matter, use a dedicated authenticator app or a hardware key, and use this tool on a device you trust.
What happens if I clear my browser data?
The accounts are erased and cannot be recovered. There is no sync and no cloud copy. Export a backup after adding accounts, and keep the recovery codes each service gave you when you enabled two-factor authentication.
Which accounts are supported?
Time-based codes (otpauth://totp) using SHA-1, SHA-256 or SHA-512, 6 to 8 digits and any period — which covers almost every service. Counter-based HOTP, Steam Guard codes and Google Authenticator bulk-export links (otpauth-migration://) are not supported. There is no built-in QR scanning; decode the QR code with the QR Code Scanner on Tooly and paste the otpauth:// text it returns.
Why is my code being rejected?
Codes are derived from your device clock, so a clock that is off by more than about thirty seconds produces codes the service will not accept. Turn on automatic time in your operating system. If the clock is right, check that the secret was copied completely and that the algorithm, digits and period match what the service issued.
Related tools
Browse all free online tools on Tooly — every one runs in your browser, with no account required.