AltF Authenticator

TOTP code generator

Paste a Base32 secret, an otpauth:// link or a QR image and you get the same time-based code your authenticator app would show. The code is calculated in your browser with the Web Crypto API and the secret is not sent anywhere. Use it to check a secret, test a setup or get a code in an emergency, not as your everyday authenticator.

  • Free, no sign-up
  • Secrets stay in your browser
  • RFC 6238 self-test built in
  • Works on mobile

Live 2FA codes

Add a secret, an otpauth:// link or a QR screenshot. Codes are calculated on this device with the Web Crypto API and refresh every period.

Spaces and lower case are fine. Base32 uses A-Z and 2-7.

Advanced: algorithm, digits, period

Leave the defaults unless the service says otherwise. An otpauth:// link sets these for you.

Accounts (0)

No accounts yet

Try the RFC demo secret to see how it works.

Secrets stay in this tab. No request made by this page contains a secret or a code, and nothing goes to analytics. Saving is optional and encrypted on this device; set a passphrase or wipe it in the 2FA Authenticator vault tool.

What you can add

  • A Base32 secret, such as JBSWY3DPEHPK3PXP. Spaces and lower case are fine; they are cleaned up for you.
  • A full otpauth://totp/ link, which also carries the issuer, account name, algorithm, digits and period.
  • A QR code image. Upload it or paste a screenshot, and the page decodes it with jsQR without uploading it.

How the code is made

The current Unix time is divided by the period (30 seconds by default) and rounded down. That number is written as 8 bytes and signed with HMAC using your secret. Four bytes are picked from the result by dynamic truncation and reduced to 6 or 8 digits. Your phone does exactly the same, which is why the codes match when the secret and the clock agree.

Settings that must match

  • Algorithm: SHA-1 is the default and by far the most common. Only change it if the service or link says SHA256 or SHA512.
  • Digits: 6 unless the service uses 8.
  • Period: 30 seconds unless the service uses 15 or 60.
  • Clock: your device time must be close to the real time. If codes fail, open the Clock check tab.

Keeping accounts between visits

By default the accounts you add are held in memory and vanish when you close the tab. If you choose Save on this device, they are encrypted with AES-256-GCM and stored in this browser's IndexedDB, with either a device key that cannot be exported or a passphrase you set. It is the same vault used by the 2FA Authenticator tool. Copied codes are cleared from the clipboard after 30 seconds where the browser allows it.

TOTP code generator: questions and answers

Will these codes match Google Authenticator?

Yes, for the same secret and settings and a correct clock. Both follow RFC 6238. If they differ, check that both devices have the right time and that the algorithm, digits and period match.

Where do I find my secret key?

On the service's 2FA setup page, look for a link such as "Can't scan the code?" or "Enter a setup key". If you already set up 2FA, most services only show the secret once, so you may need to turn 2FA off and on again to see a new one.

Is my secret uploaded?

No. The secret and any QR image stay in your browser. You can confirm this in your browser's developer tools on the Network tab.

Why does the next code preview help?

If the countdown is almost over, you can see the code that comes next and wait for it instead of racing the timer.

Authenticator tools and 2FA guides

All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.otpauth QR code generatorBuild an otpauth:// URI with issuer, account, algorithm, digits and period, and draw the 2FA setup QR code in your browser. Free, nothing uploaded.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.HOTP generatorGenerate HOTP counter-based one-time passwords per RFC 4226 from a Base32 secret and any counter value. Includes the RFC test values. Runs in your browser.Google Authenticator export decoderDecode a Google Authenticator Export accounts QR (otpauth-migration://) into standard otpauth links and secrets, locally in your browser. Nothing uploaded.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.

Guides

What is TOTP?What TOTP is, how authenticator apps make 6-digit codes from a secret and the time, how it compares with SMS and passkeys, and what it protects against.Lost phone 2FA recoveryLost or reset the phone with your authenticator app? Steps to get back into accounts with backup codes or recovery, then set 2FA up safely again.SMS vs authenticator appSMS codes, authenticator apps, passkeys and security keys compared: what each protects against, the risks of SIM swap and phishing, and what to choose.

AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.