About this tool

Last updated: 7 August 2026

2FA Live Code exists because two-factor codes are easy to calculate and hard to reach when your phone is not in your hand. This site does the calculation in your browser, keeps nothing, and tries very hard to be honest about what it can and cannot do.

Why it was built

Two-factor authentication is one of the best things you can do for your online security. But tying it to a single phone creates its own problem: a flat battery, a lost handset, or a phone in the other room, and you are locked out of your own accounts.

There are plenty of online 2FA generators. Looking closely at them, most share the same serious flaws: they support only one variant of the standard and silently produce wrong codes for anything else; they skip invalid characters in a key rather than rejecting it, so a typo quietly yields a plausible-looking wrong code; and several store your secret keys in your browser as readable plain text while claiming to be private. This one was built to do those things properly.

What makes it different

• The complete standard. SHA-1, SHA-256 and SHA-512, 6 to 8 digits, and any refresh interval — read automatically from your key rather than assumed.
• Verified arithmetic. Checked against every official RFC 6238 test vector, and it re-runs those checks each time it starts, refusing to display codes if any fail.
• Honest errors. An invalid key produces a clear message, never a wrong code.
• Real Google Authenticator import. One scan of the app's export code brings every account across — something very few web tools can do.
• Several accounts on one screen. Codes from more than one Google account together, which the Google Authenticator app itself cannot manage.
• Encryption when you ask for it. Saved keys are encrypted with a passphrase before anything is written to your device.
• Yours to keep. The entire tool is one file you can download and run offline forever, with no connection and no dependency on this site continuing to exist.

What it deliberately does not do

It does not claim to be safer than a dedicated authenticator app or a hardware security key. It is not. Any hosted web page can change, and that is a genuine risk we would rather state than paper over — which is exactly why the downloadable single-file version exists.

It also does not support counter-based (HOTP) keys or Steam Guard codes, and a forgotten passphrase cannot be recovered by anyone, including us.

Who is behind it

2FA Live Code built and maintains this site. It is run as a free tool with no accounts, no advertising and no tracking.

If you would like to report a problem, suggest a feature, or ask how something works, get in touch.

How it works, briefly

A two-factor code is a fixed calculation: your secret key plus the current 30-second block of time, run through a standard hash, truncated to six digits. The website you are logging into performs the same calculation and compares. Nothing needs to be transmitted for that to work, which is why this page can do it offline. If you would like the full explanation, the step-by-step guide covers everything.