Free 2FA Authenticator & TOTP Code Generator

Generate TOTP-based 2FA codes instantly in your browser. Your secret key stays on your device and is not sent to Atlas Accounts.

  • RFC 6238 TOTP
  • SHA1 · SHA256 · SHA512
  • 6 or 8 digits
  • No sign-up

A Base32 key (letters A–Z and digits 2–7) or an otpauth://totp/ link. Spaces, hyphens and lower case are fine.

Advanced settingsSHA1 · 6 digits · 30 s

Your TOTP secret is processed locally in your browser and is not sent to Atlas Accounts. It is never saved — clearing the field, leaving the page or closing the tab removes it.

How to use the Atlas 2FA Authenticator

  1. Find your secret key

    When a service asks you to set up an authenticator app, it shows a QR code. Most setup screens also have a “Can’t scan it?” or “Enter a setup key” link that reveals the key as text — usually 16 or 32 characters such as JBSW Y3DP EHPK 3PXP.

  2. Paste the key or scan the QR code

    Paste the key into the TOTP Secret Key field. Spaces, hyphens and lower-case letters are fine. You can also paste the full otpauth:// link, or choose Scan QR Code to use your camera or upload a screenshot of the code.

  3. Generate the code

    Select Generate Code. The current 6- or 8-digit code appears with a countdown showing how long it stays valid.

  4. Enter it before the countdown ends

    Type or copy the code into the service. When the countdown reaches zero a new code appears automatically — if only a few seconds are left, wait for the next one.

  5. Clear the key when you are done

    Select Clear to remove the key from the page. Leaving the page or closing the tab removes it too.

What is a TOTP code?

A TOTP code — a time-based one-time password — is the short number an authenticator app shows for two-factor authentication (2FA). It is calculated from two things only: a secret key that you and the service share, and the current time. The standard that defines it is RFC 6238.

Because the code depends on the time, it is only valid for a short window, usually 30 seconds. A stolen code is useless moments later, which is what makes TOTP a strong second factor on top of your password.

How TOTP works

Nothing is sent between your authenticator and the service when a code is generated. Both sides run the same calculation independently and simply compare results:

  1. During setup the service creates a random secret key and gives it to you, usually inside a QR code.
  2. To make a code, the current Unix time is divided into steps — by default 30 seconds each — and the step number is counted from 1 January 1970.
  3. The step number is signed with the secret key using HMAC with SHA-1 (or SHA-256 / SHA-512 if the service asks for it).
  4. A process called dynamic truncation (RFC 4226) turns that signature into a number, and the last 6 or 8 digits become the code.
  5. The service repeats the same steps with its copy of the key. If the numbers match, you are in. Many services also accept the code from the step just before or after, to allow for small clock differences.

What is a TOTP secret key?

The secret key (also called a setup key, seed or 2FA key) is the random value behind every code. It is written in Base32, which uses only the letters A–Z and the digits 2–7, and is often shown in groups of four characters. Most keys are 16 or 32 characters long.

A QR code for 2FA simply contains this key inside an otpauth:// link, for example otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example. The link can also say which hash algorithm, how many digits and what time step the service uses, and this tool reads those settings automatically.

Anyone who has the key can generate your codes, so treat it like a password. If you received a 2FA key together with an account, it is this same kind of key — paste it here to get the current login code.

Security & privacy

The Atlas 2FA Authenticator is built so that your key never has to leave your device:

  • The key is decoded and the code is calculated in your browser, using its built-in Web Crypto API. There is no Atlas server endpoint for this tool.
  • The key is not saved in cookies, local storage or session storage, and it is never put in the page address.
  • This page loads no analytics, advertising or session-recording scripts, so no third-party script can read what you type.
  • QR codes are decoded on your device. Camera access starts only when you choose to scan, and the camera turns off as soon as a code is read or you close the scanner. Uploaded images are never sent anywhere.
  • Select Clear, leave the page or close the tab and the key is gone.

Good habits

  • Use this tool on a device and browser you trust. Browser extensions can read anything on a page, including this one.
  • For accounts you use every day, keep the key in an authenticator app or password manager that is backed up — a browser tab is not a place to store it.
  • Never share your secret key, a screenshot of its QR code, or a live code with anyone who asks for it.
  • Only use it for accounts you own or are authorized to access.

You can check this yourself: open your browser’s developer tools, switch to the Network tab, paste a key and generate a code. No request carries your key.

Why does my 2FA code change every 30 seconds?

Each code belongs to one time step. The 30-second step recommended by RFC 6238 is short enough that an intercepted code expires almost immediately, yet long enough to read and type it comfortably.

A few services use a different step, such as 60 seconds. If their QR code or otpauth:// link includes a period setting, this tool uses it automatically; otherwise you can set it under Advanced settings.

Troubleshooting

The service rejects the code
Check your device clock first. Codes are calculated from the time, so a clock that is off by more than about 30 seconds produces wrong codes. Turn on automatic date and time, then generate a new code.
“This key contains characters that aren’t valid”
Base32 keys use only A–Z and 2–7. The digits 0, 1, 8 and 9 never appear — you may be reading O as 0, I or L as 1, or B as 8. Spaces and hyphens are fine.
The code is valid but still wrong
The service may use SHA-256 or SHA-512, 8 digits, or a 60-second step. Paste the full otpauth:// link or scan the QR code so these settings are picked up, or set them under Advanced settings.
The code expired while I was typing it
Wait for the next code when only a few seconds remain. Most services accept a code for a short grace period, but not indefinitely.
“This QR code uses HOTP”
HOTP codes are based on a counter instead of the time. The Atlas 2FA Authenticator currently supports TOTP only.
A Google Authenticator export QR code doesn’t work
Export QR codes (otpauth-migration://) bundle several accounts in a different format. Scan the original setup QR code, or get a new setup key from the service.
The camera doesn’t start
Allow camera access when your browser asks. If the camera is unavailable or blocked, take a screenshot or photo of the QR code and choose Upload image instead.

Frequently asked questions

What is a TOTP code?

A TOTP (time-based one-time password) code is a short number, usually 6 digits, used as the second step of two-factor authentication. It is calculated from a secret key and the current time as defined in RFC 6238, and it changes every 30 seconds by default.

What is a 2FA secret key?

It is the random key a service gives you when you turn on authenticator-app 2FA, usually hidden inside a QR code and also shown as 16 or 32 Base32 characters. Your authenticator uses it to calculate codes, so anyone who has it can generate them — keep it private.

Does Atlas Accounts store my secret?

No. The key is processed only in your browser’s memory. It is never sent to Atlas Accounts, never saved in cookies, local storage or the page address, and it is removed when you select Clear, leave the page or close the tab.

Can I use this with every 2FA service?

It works with any service that uses standard TOTP (RFC 6238) — which covers most services that offer “authenticator app” two-factor authentication. It does not replace SMS codes, push approvals, hardware security keys, counter-based HOTP, or proprietary formats that don’t use numeric TOTP codes.

Why does the code change every 30 seconds?

Each code is tied to a 30-second time step, so an intercepted code expires almost immediately. Some services use a different step, such as 60 seconds; the tool reads it from the QR code or otpauth:// link, or you can set it under Advanced settings.

Why is my 2FA code not working?

The most common cause is a device clock that is out of sync — turn on automatic date and time. Otherwise, check the key for mistyped characters (Base32 uses only A–Z and 2–7) and make sure the algorithm, number of digits and time step match what the service uses.

Can I scan a QR code?

Yes. Choose Scan QR Code to use your camera, or upload a screenshot or photo of the QR code. Decoding happens on your device; the image is never uploaded and the camera stops as soon as the code is read.

What is the difference between TOTP and HOTP?

Both come from the same algorithm. HOTP (RFC 4226) creates a new code each time a counter increases, for example when you press a button. TOTP (RFC 6238) uses the current time as the counter, so codes expire automatically. This tool supports TOTP.