2·2facheck.
Private by design
▣ THE AUTHENTICATOR THAT STAYS ON YOUR DEVICE

Your codes.
Your peace of mind.

ONLINE AUTHENTICATOR

Generate a 2FA code

Runs locally
or drop / paste an image into the input

New here? View the guide ↓
Advanced settings SHA-1 · 6 digits · 30 seconds
− − −   − − −

Your code will appear here

Ready when you are.
♧ Your secret stays in this browser. Never sent to a server.
◈   Processed on your device·◷   Auto-refreshing codes·◎   Free to use. Always.
FROM SECRET TO SECURE, IN SECONDS

How to use 2facheck

No setup to slow you down.

01

Bring your secret

Paste the Base32 secret provided when you set up two-factor authentication.

02

Get your code

Generate a time-based code instantly. It refreshes automatically every 30 seconds.

03

Copy. Sign in. Done.

Copy your current code and enter it in the service you're signing in to.

First time here? Start with this.

You need the 2FA setup secret supplied by your service, rather than your login password or an old one-time code.

OPTION 1 · SECRET KEY

Paste a Base32 secret

Find the manual setup key in your service's authenticator settings. Base32 uses letters A–Z and numbers 2–7.

GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQThis public test key is for demonstration only.
OPTION 2 · SETUP LINK

Paste an otpauth://totp link

If your service provides a setup link, paste the whole link into the input. The tool reads the settings from that link.

otpauth://totp/Example?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ&digits=6&period=30Paste the link into 2facheck's input, rather than opening it in the address bar.
OPTION 3 · QR IMAGE

Read a setup QR image

Choose “Read QR image” below the input to select an image from your device. You can also drop or paste an image into the input.

Use a clear image with one 2FA setup QR code: PNG, JPG or WebP, up to 10 MB.

Once read, choose “Get code”. The image is processed on your device and is never uploaded.
Which settings should I choose?

For plain secrets, match your service's algorithm, digits and period under “Advanced settings”. The defaults are SHA-1, 6 digits and 30 seconds. Links use their own settings independently. You can enter up to 20 lines.

What happens after “Get code”?

  1. Choose “Copy code” for the result you need.
  2. Return to the service you are signing in to and paste the code into its two-step verification field.
  3. If the code is about to expire, wait for a new one and copy again. Do not use the demo key for a real account.
Code rejected? Check these four things
  • Enable automatic date and time on your device.
  • Check that the secret belongs to the right account and is still active.
  • Match the algorithm, digit count and period with your service.
  • Use a fresh code before it expires. Services may reject a code that was already used successfully.

If you lost your secret or account access, use recovery codes or contact the service. 2facheck cannot recover secrets or bypass 2FA.

THE BASICS, SIMPLY EXPLAINED

A little knowledge.
A stronger sign-in.

What is 2FA?

Two-factor authentication adds a second check to your password. An authenticator code proves access to your shared secret. Keep that secret as carefully as your password.

What is TOTP?

A time-based one-time password combines a shared secret with the current time. 2facheck uses the RFC 6238 standard and supports HMAC-SHA1, SHA256 and SHA512 with 6 or 8 digits.

How does an authenticator work?

Your service and authenticator calculate the same code independently. Match the algorithm, digit count and period from your service. Your device clock needs to be accurate.

Good questions.

Is this 2FA generator safe?

Codes are generated directly on your device. We do not transmit or save your secrets. A compromised device or browser extension can still read them. A dedicated authenticator is a better choice for long-term storage.

Why isn't my code working?

Check your device's automatic date and time, secret, algorithm, digits and period. Use the newest code before it expires. This tool cannot recover a lost secret or bypass 2FA.

Can I generate several codes at once?

Yes. Enter up to 20 Base32 secrets or otpauth://totp links, one per line. Links supply their own settings; advanced settings apply to plain secrets. Each result refreshes independently and can be copied or removed.

Are my keys saved when I leave?

No. Keys are held only in this page's memory. Clearing or leaving the page releases our references to them. JavaScript cannot guarantee immediate physical memory erasure.

Where do I find my secret key?

Your service usually provides a manual setup key alongside its authenticator QR code. Never share it. 2facheck accepts Base32 keys and otpauth://totp setup links, including algorithm, digits and period. Choose, drop or paste a setup QR image into the input to read it locally. Counter-based HOTP links are not supported.