AltF Authenticator

SMS or authenticator app for two-factor authentication?

An authenticator app is safer than SMS for most people, because the code is made on your device and cannot be stolen by a SIM swap or intercepted on the phone network. Passkeys and hardware security keys are stronger again, because they also resist phishing. Any second factor is far better than a password alone.

  • Free, no sign-up
  • Secrets stay in your browser
  • RFC 6238 self-test built in
  • Works on mobile

The risks of SMS codes

  • SIM swap: an attacker convinces your carrier to move your number to their SIM and receives your codes.
  • Interception: weaknesses in phone network signalling have been used to redirect text messages.
  • Phishing: a fake site can ask for the SMS code and use it at once.
  • No signal: codes do not arrive abroad or where coverage is poor.

What an authenticator app fixes, and what it does not

TOTP codes are made on your device from a secret, so a SIM swap does not give an attacker your codes, and they work without signal. They can still be phished in real time. And if you lose the phone without backup codes, recovery can be slow. NIST's digital identity guidance (SP 800-63B) treats SMS as a restricted method and accepts app-based one-time passwords.

Passkeys and security keys

A passkey or a hardware security key signs a challenge that is tied to the real website's address. A fake site gets nothing it can reuse, so these methods resist phishing. Where a service offers them, they are the strongest common choice. Keep a backup method enrolled.

What to choose

  • Email and banking: a passkey or security key if offered, otherwise an authenticator app.
  • Everything else: an authenticator app, with backup codes saved offline.
  • SMS: use it only when nothing else is offered, and ask your carrier for a SIM lock or port-out PIN.

Live 2FA codes

Add a secret, an otpauth:// link or a QR screenshot. Codes are calculated on this device with the Web Crypto API and refresh every period.

Spaces and lower case are fine. Base32 uses A-Z and 2-7.

Advanced: algorithm, digits, period

Leave the defaults unless the service says otherwise. An otpauth:// link sets these for you.

Accounts (0)

No accounts yet

Try the RFC demo secret to see how it works.

Secrets stay in this tab. No request made by this page contains a secret or a code, and nothing goes to analytics. Saving is optional and encrypted on this device; set a passphrase or wipe it in the 2FA Authenticator vault tool.

SMS or authenticator app for two-factor authentication?: questions and answers

Is SMS 2FA better than nothing?

Yes. It still stops most attacks that rely only on a leaked password.

Can an authenticator app be hacked?

The codes themselves cannot be predicted without the secret. The risks are malware on the phone, phishing in real time, and losing the phone without a backup.

Should I remove my phone number from accounts?

Where you have an authenticator app or passkey set up, removing SMS as a fallback reduces SIM swap risk. Make sure you have backup codes first.

What is a SIM swap?

It is when someone moves your phone number to a SIM card they control, often by tricking your carrier. They then receive your calls and text messages.

Start from what happened

Authenticator tools and 2FA guides

All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.TOTP code generatorGenerate TOTP 2FA codes from a Base32 secret, otpauth:// link or QR image. SHA-1, SHA-256 or SHA-512, 6 or 8 digits, calculated in your browser.otpauth QR code generatorBuild an otpauth:// URI with issuer, account, algorithm, digits and period, and draw the 2FA setup QR code in your browser. Free, nothing uploaded.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.HOTP generatorGenerate HOTP counter-based one-time passwords per RFC 4226 from a Base32 secret and any counter value. Includes the RFC test values. Runs in your browser.Google Authenticator export decoderDecode a Google Authenticator Export accounts QR (otpauth-migration://) into standard otpauth links and secrets, locally in your browser. Nothing uploaded.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.

Guides

What is TOTP?What TOTP is, how authenticator apps make 6-digit codes from a secret and the time, how it compares with SMS and passkeys, and what it protects against.Lost phone 2FA recoveryLost or reset the phone with your authenticator app? Steps to get back into accounts with backup codes or recovery, then set 2FA up safely again.

AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.