Free 2FA code generator and authenticator toolkit

The most common cause is a wrong device clock. TOTP codes depend on the current time, and most services only accept codes from a small window around it, so a clock that is off by more than about 30 seconds gives codes the server rejects. Turn on automatic date and time, then try again. Other causes are a mistyped secret, the wrong account, or non-default settings such as SHA-256 or 8 digits that your app ignored. The Clock check and Verify tabs help you find which one it is.

It depends on where the secret goes. Here the code is calculated in your browser and the secret is not sent to any server, which you can confirm in your browser's network tab. Even so, a browser tab is a weaker place to keep a secret than an authenticator app, because extensions and malware on the device can read the page. Use it on a device you trust, for checking, testing, migrating or an emergency, and keep the secret in a proper app.

It is a random shared key that a service gives you when you turn on app-based 2FA. It is usually shown as Base32 text (letters A to Z and digits 2 to 7) and is also inside the setup QR code. Your app and the server both combine the secret with the current time to make the same 6-digit code. Anyone who has the secret can make your codes, so treat it like a password.

Not as your everyday authenticator. By default the accounts you add here are gone when you close the tab, and a browser is easier to attack than a phone app. It produces the same codes as Google Authenticator for the same secret, which makes it useful to check a secret, test a setup or get a code in an emergency. Keep your secrets in a dedicated authenticator app or a password manager.

On the old phone, open Google Authenticator, choose Transfer accounts, then Export accounts, and scan the QR code (or codes) with Google Authenticator on the new phone. Check that every account shows a code on the new phone before you remove anything from the old one. If you want to move the accounts to a different app, the Decode export tab can turn the export QR into standard otpauth:// links locally.

Not unless you ask it to. By default accounts live only in the page's memory. If you turn on Save on this device, they are encrypted with AES-256-GCM and stored in this browser's IndexedDB, protected by a non-extractable device key or by your passphrase. Nothing is uploaded and there is no account or sync.

Sign in on another device and use one of the backup codes the service gave you when you set up 2FA, or another method you enrolled such as a security key or a second phone. If you have none, use the service's account recovery process. Once you are in, remove the old authenticator, set up 2FA again on your new device and save new backup codes.

Some services use non-default settings: 8 digits, a 60-second period or HMAC-SHA-256 or SHA-512. These are allowed by RFC 6238 and are written into the otpauth:// link. Some versions of Google Authenticator have ignored these parameters, so if your app shows a 6-digit code that keeps failing, add the account here from the full link to see the code the service expects.

Both use the same HMAC and truncation steps. HOTP (RFC 4226) uses a counter that goes up each time you make a code, so the code stays valid until it is used. TOTP (RFC 6238) uses the current time divided into 30-second steps as the counter, so each code expires on its own. Most websites use TOTP.

No. They are random codes made in your browser for your own use, for example if you are building a 2FA system and need codes to register, or want a template. Real backup codes for Google, Microsoft or any other service must come from that service's security settings.

No. It makes one request to AltFTool's own server to read the server's time, and the request contains no secret, code or account name. Every other tab works without sending anything.