Free online 2FA code generator

1 · What this 2FA generator is

When a website offers "two-factor authentication" and you choose Authenticator app, it gives you a setup key — a string of letters and digits, often shown as a QR code. That key plus the current time produces a six-digit code that changes every thirty seconds. The website runs the same calculation and checks that your code matches.

That six-digit number goes by several names — a 2FA code, an auth code, a verification code, a one-time password (OTP), or a TOTP code. They all mean the same thing.

2FA Auth Code does that calculation. Give it your setup key and it shows the code, right now, in your browser. Nothing is sent anywhere: the arithmetic happens on your own device, which is why the page still works with your internet switched off.

It is an alternative to phone apps like Google Authenticator, Authy, or Aegis — useful when your phone isn't nearby, when you're moving to a new device, or when you simply prefer working on a desktop.

2 · Getting your first 2FA code

Three actions, about ten seconds:

1. Find your setup key. It's the code the website showed you when you turned on two-factor login — usually 16 or 32 letters and digits, often in groups of four. People keep it on paper, in a notes app, or in a password manager. If you're setting up 2FA right now and only see a QR code, look for a link like "Can't scan it?" or "Enter key manually".
2. Paste it. Into the box at the top of the page — or literally anywhere on the page, since 2FA Live Code watches for pasted keys. Spaces, dashes and lower case make no difference.
3. Copy the code. The six digits appear in the code display beside the box. Click the digits themselves, or the Copy code button, and paste them into the website.

Tip: if the code is about to expire, don’t submit it with two seconds left — reading your 2FA code display explains the safer way.

3 · Reading your 2FA code display

The code display sits beside the key box and updates itself continuously. Four things are worth knowing about it.

• The six digits are your current 2FA authenticator code. Each digit turns over as a new code is generated, so you can see the change happen rather than wondering whether the number on screen is still valid.
• Code expires in counts down the seconds until this code expires, with a bar underneath draining alongside it. Under five seconds it turns red.
• Then … shows the next code before it becomes active — something most online 2FA generators don't offer.
• Copy next instead appears during those last five seconds. Use it when you're about to run out of time: it copies the upcoming code, which will be valid the moment the current one dies, giving you a full thirty seconds to finish logging in.
• The digits are a button. Clicking or tapping the code copies it — useful on a phone, where hunting for a button mid-login is the last thing you want.

4 · Four ways to add a key

1. Paste. Into the box, or anywhere on the page. 2FA Live Code will even find a key buried inside pasted text — if you paste a whole email that says "Your secret key: K5RG QZLM N4TX HB2W — keep it safe", it extracts just the key.
2. Import Google Authenticator. Moves every account out of the Google Authenticator app in one scan — see importing Google Authenticator.
3. Scan QR. Uses your camera to read the QR code a website shows during 2FA setup. Point and it loads automatically.
4. Upload QR image. If you already saved a screenshot or photo of the QR code, pick the file and the key is read from the picture.
5. Drag and drop. Drop a QR screenshot anywhere on the page — no button needed.

Whichever method you use, the key also joins your saved 2FA accounts list below, where it keeps generating codes alongside everything else you've added.

5 · Importing everything from Google Authenticator

This is the feature almost no other web tool has. Google Authenticator can hand over all of its accounts at once, in a single QR code, and 2FA Live Code can read it.

1. Open Google Authenticator on your phone.
2. Tap the menu and choose Transfer accounts, then Export accounts.
3. Select the accounts you want and continue. The app displays a QR code — this one contains every selected key, not just one.
4. Back here, press Import Google Authenticator — the amber button under the key box. Name the source if you like, then choose Scan the QR code and point your camera at the phone. (Or screenshot the QR and choose Upload screenshot instead.)
5. Every account appears in your saved 2FA accounts list at once, with its name, algorithm and digit count preserved, grouped under the source name you gave.

If your export is split across several QR codes — Google does this when you have many accounts — 2FA Live Code tells you which part you just scanned and how many remain. Scan the rest the same way.

Note: counter-based accounts (a rare, older type called HOTP) can't be imported. If your export contains any, 2FA Live Code imports everything else and tells you exactly how many it skipped rather than dropping them silently.

6 · Many accounts on one screen

Google Authenticator ties its accounts to whichever Google account you're signed into. If you keep a work Gmail and a personal Gmail, you end up signing out and back in just to read a code. 2FA Live Code keys aren't tied to any account, so they can live together.

1. Export from the first Gmail, press Import Google Authenticator, and name the source Personal Gmail.
2. Export from the second Gmail and repeat, naming that one Work Gmail.
3. Both sets now appear in your saved 2FA accounts list, grouped under headings, each with its own count.

Above the list, source chips let you show one account's keys at a time or all of them together. Once you pass six keys a filter box appears — type any part of a name or source to narrow the list. Click a group heading to rename it.

Each row carries its own little countdown ring, so a sixty-second key and a thirty-second key each show their true remaining time. To keep this list between visits, see saving your keys safely.

7 · Moving a key to your phone

Every row in your saved 2FA accounts list has a small QR icon. Press it and 2FA Live Code draws a standard QR code for that key — scan it with Google Authenticator, Aegis, 1Password, or any authenticator app, and the account moves across.

This makes the tool a two-way bridge: keys can come in from a phone and go back out to a new one, which is exactly what you need when replacing a device.

Careful: anyone who photographs that QR code owns the account. Don't screen-share, screenshot into a chat, or show it in a public place.

8 · Saving your keys safely

By default nothing is stored: close the tab and your keys are gone. That's the safest setting, and the right one on a shared or public computer. Whatever you choose here, also read backing up your keys — a vault on one machine is not a backup.

On your own machine you'll usually want them to stick around. Under Saved 2FA accounts, choose Save these on this device and set a passphrase.

• Your keys are encrypted before they're stored, using AES-256 with your passphrase stretched through 310,000 rounds of key derivation. Without the passphrase the stored data is meaningless — to anyone, including someone sitting at your keyboard.
• The badge in the header shows the state: Keys: this tab only, Saved keys: locked, or Saved keys: open.
• Press the badge to lock the vault again. Locking clears the passphrase from memory; your keys stay on screen until the tab closes.
• Next visit, press Unlock saved keys, type your passphrase, and everything returns.

There is no password reset. The passphrase is never stored anywhere, which is precisely what makes the vault safe — and it means a forgotten passphrase cannot be recovered by us or anyone else. Write it down somewhere real, and keep your original setup keys backed up offline regardless.

9 · When the website says your code is wrong

Nine times in ten this is a clock problem, not a mistake on your part. The code is derived from the current time, so if your computer's clock drifts by even a minute, the codes it produces won't match what the website expects.

1. Press Check clock in the header. 2FA Live Code compares your device against internet time and reports the difference.
2. If your clock is off, 2FA Live Code corrects for it automatically — the badge reads "Synced" and codes will now be accepted even though your system clock is still wrong.
3. Fix the system clock too, when convenient: turn on automatic time synchronisation in your operating system's date and time settings. Other apps will thank you.

Other causes worth checking: the code expired while you were typing (use Copy next instead, explained in reading your 2FA code display), or the key was mistyped. 2FA Live Code refuses invalid keys outright rather than producing a plausible-looking wrong code, so if it accepted your key, the key itself is fine.

10 · Using it offline, and installing it

Codes are calculated on your device, so no connection is needed. There are three levels of independence:

1. Visit once. The page saves itself to your browser. Afterwards it opens and works with no internet at all — on a plane, on a dead connection, anywhere. When the connection drops, a badge appears confirming codes still work.
2. Install it. Press Install app in the header (what that does, and the iPhone steps). Where your browser supports it, that's a single tap; where it doesn't — Safari on iPhone and iPad, for instance — the button shows the exact steps for your browser instead. Either way you end up with an icon that opens 2FA Live Code in its own window, offline.
3. Download the file. The entire tool is a single HTML file — QR scanner included, nothing loaded from anywhere else. Save it and open it from your own disk. A file you hold can never be changed behind your back, which makes this the most trustworthy version there is. It checks its own arithmetic against the official test vectors every time it starts, and refuses to show codes if anything is wrong.

11 · Algorithm settings (most people never need these)

Under the key box, Algorithm settings opens three controls: hash, digits, and refresh interval. Almost every service in the world uses SHA-1, 6 digits and 30 seconds, which are the defaults.

You don't normally touch these, because a scanned QR or an otpauth:// link carries its own settings and 2FA Live Code applies them automatically — including unusual ones like 45-second intervals. Change them by hand only if a service explicitly tells you to, or if you pasted a bare key for an account you know uses something different.

If a key asks for something genuinely unsupported — a rare hash, or ten-digit codes — 2FA Live Code says so plainly rather than falling back to a default and producing codes that would never work.

13 · Backing up your keys

Everything so far lives in one browser on one machine — see saving your keys safely for how that storage works. If that machine dies, or the browser clears its storage, your keys go with it — which is why two backup options sit under your saved accounts list.

Download backup (encrypted file)

1. Press Download backup and choose a passphrase for the file. It can be the same one as your vault, or different.
2. A .2fa file downloads. Your keys inside it are encrypted with AES-256 — opening the file in a text editor shows nothing but random characters.
3. Keep it wherever you keep important files: a USB stick in a drawer, an encrypted drive, a password manager's file attachment.
4. To bring it back — on any machine, in any browser — press Restore backup, pick the file, and enter its passphrase. Keys already present are skipped, so restoring twice is harmless.

The file describes its own format in plain text at the top (cipher, key derivation, iteration count), so it isn't a black box you have to trust us about — anyone with the passphrase can decrypt it with standard tools. If the file is altered by so much as a single character, restoring fails rather than returning corrupted keys.

Print recovery sheet (paper)

Print recovery sheet opens a clean printable page: one row per account with its name, source, setup key in readable groups of four, its settings, and a QR code any authenticator app can scan. Paper survives dead laptops, forgotten passphrases and browser updates — it is the backup that has no dependencies at all.

Treat that sheet like cash. Every key on it works. Store it somewhere physically secure, don't photograph it, and shred it when it's out of date. Print it on a printer you control — not a shared office or library machine, which may keep a spooled copy.

12 · Staying safe

• Keep your original setup keys offline. Paper in a drawer, or an encrypted password manager. That backup — not this page, not your phone — is what gets you back into your accounts when everything else is lost.
• Don't use the vault on a shared computer. The default "this tab only" mode exists for exactly that situation.
• Never send a setup key or an export QR to anyone, in any chat, for any reason. Nobody legitimate will ask for it.
• For your most valuable accounts — primary email, banking, anything holding money — a dedicated authenticator app or a hardware security key is a safer home for the secret than any web page, including this one. A hosted page can change; that risk is real and we'd rather say so than pretend otherwise. Downloading the file removes it.
• Two factors beat one. Whatever you use, having 2FA on at all is a far bigger security win than the choice of which tool generates the codes.