Online 2FA Code Generator
Paste your 2FA secret key to get the current 6‑digit code. The codes match Google Authenticator, and everything is calculated in your browser.
The string of letters and digits a site shows next to the QR code when you turn on two-factor authentication. An otpauth:// link works too. Spaces, dashes and letter case don’t matter.
How to use it
Find your secret key
When turning on two-factor authentication, choose “Can’t scan?” or “Enter manually”. The string of letters and digits that appears is the key.
Paste it above
The code appears right away and refreshes every 30 seconds.
Enter the code
Press “Copy” and paste it into the site. If only a few seconds are left, wait for the next code to be safe.
Is my secret key uploaded?
No. A key you paste into the box is only processed in your browser and is never sent to our server.
- After the page has loaded it only makes two kinds of requests: a time check that corrects your device clock, and the QR code script when you open the QR code. Neither contains your key.
- Links made with “Copy link” put the key after the # sign. Browsers never send the part after # to a server.
- Exception: if you type the key into the address yourself (for example nebarc.com/tools/2fa/YOURKEY), or use the developer API below, the key does pass through our server.
Questions
Are the codes the same as Google Authenticator’s?
Yes. Google Authenticator, Microsoft Authenticator, Authy and 1Password all follow the same standard (TOTP, RFC 6238). With the same key and the correct time, they all produce the same code.
Is it safe to use?
Your key is not uploaded, but the key itself is valuable: anyone who has it can generate your codes at any time. Whether it is safe depends on where you use it and who you give it to.
- Good for: getting a code when your phone is not at hand, test accounts, development and debugging.
- Avoid using it on public computers or other people’s computers.
- Avoid sending a link that contains the key to anyone you do not fully trust.
- Avoid storing the key next to your password: that removes the “second factor” protection.
Where do I find my secret key?
When you turn on two-factor authentication, the site usually shows a QR code with a “Can’t scan?” or “Enter manually” option. Choose it to see the key. Most sites do not show the key again later; you would have to turn 2FA off and set it up again.
The site rejects my code. What should I check?
- The key was copied completely. One missing character gives a wrong code.
- The code had not just changed. Wait for the countdown to finish and try the new code.
- The site uses special settings (such as 8 digits or a 60-second interval). If you have the otpauth:// link, paste the whole link and they are applied automatically.
This page corrects your clock automatically, so a wrong device clock is rarely the cause.
What is the “Next” code for?
It becomes the current code when the countdown ends, so you can see it coming instead of copying a code that expires while you paste it. Some sites accept the next code early, but not all do, so it is safest to use it once it has become the current code.
Developer API
For scripts and automation. The response contains the current code, the next code and the seconds remaining.
With the API, your key is sent to our server. Our code does not store it and request logging is turned off, but for important accounts use the tool above instead.
# JSON response
curl -X POST https://api.nebarc.com/tools/2fa/totp \
-H 'content-type: application/json' \
-d '{"secret":"JBSWY3DPEHPK3PXP"}'
# Plain text: only the 6-digit code
curl 'https://api.nebarc.com/tools/2fa/totp/JBSWY3DPEHPK3PXP?format=text'- Prefer POST: the key goes in the request body and never appears in a URL.
- Each IP address is rate limited. When you exceed the limit you get HTTP 429; wait for the number of seconds in the Retry-After header, then retry.