RunLocalTools

TOTP Authenticator & Code Generator (2FA) — Free, Private, In Your Browser

Generate TOTP 2FA codes from a secret key in your browser. SHA-1/256/512, 6–8 digits, Steam Guard, QR import, a debug view and encrypted storage. Nothing uploaded.

What it does

Paste a Base32 secret key (or an otpauth:// link) and this tool shows the live six-digit code that an authenticator app would show, with a countdown and the next code ready. Add as many accounts as you like and they stay available after a refresh. You can also import accounts from a QR image or camera scan, or from Google Authenticator’s “export accounts” QR, and create a brand-new secret with a QR code to scan into any app.

It goes beyond a plain code viewer. It supports SHA-1, SHA-256 and SHA-512, 6, 7 or 8 digits, custom periods from 10 to 120 seconds, and Steam Guard’s 5-character codes. A built-in debug view shows exactly how each code was computed, which is useful when you are building or testing two-factor login.

How it works

TOTP (RFC 6238) is HMAC applied to the current time. The tool decodes your Base32 secret into bytes, divides the current Unix time by the period (30 seconds by default) to get a counter, and signs that counter with HMAC using your chosen hash. It then takes four bytes from the result at an offset taken from the last byte (“dynamic truncation”, RFC 4226), keeps 31 bits, and reduces that number to the number of digits you need. The browser’s built-in Web Crypto API does the HMAC, so no cryptography library is involved, and the tool is checked against the official RFC test vectors for all three hashes.

Steam Guard uses the same HMAC-SHA-1 step but turns the 31-bit value into five characters from a 26-letter alphabet instead of digits.

The Details panel on each account shows the Unix time, the time-step counter, the full HMAC with the four truncated bytes highlighted, the truncation offset, and the previous, current and next codes with their valid time ranges. If you work with raw Base32 data in other contexts, the Base32 encoder / decoder shows the same encoding on arbitrary text.

How to use it

  1. Open Add / import and paste your secret key into the secret field. The code appears immediately as a live preview, before anything is saved.
  2. Add the issuer and account name, then click Add account. If the service gave you an otpauth:// link, paste that into the secret field instead and the other fields fill in automatically.
  3. Open Accounts to see all your codes. Click a code (or Copy code) to copy it. Use Hide codes until clicked if you are sharing your screen.
  4. To import many accounts, paste links or secrets one per line, drop a screenshot of a QR code, paste an image from the clipboard, or use Scan with camera. To bring accounts over from Google Authenticator, scan or drop its export QR code and every account in it is imported. (If you only want to read a QR code without importing it, the QR code scanner does that on its own.)
  5. Turn on the passphrase lock in the side panel if you want your saved accounts encrypted, and use Export backup to keep an offline copy.

Features that are usually paywalled or missing

  • Unlimited accounts, no sign-up and no ads between you and your codes.
  • Verify a code: type the code a service expects and the tool tells you whether it matches the current, previous or next window, and can apply a clock offset to fix drift.
  • A manual clock offset for devices whose clocks are wrong.
  • Create a new random secret (128 to 512 bits) with a scannable QR code and a live code to compare against your app. Pair it with the password generator when you are setting up a whole account.
  • Encrypted backups and an optional encrypted vault in this browser.
  • Export any account as an otpauth:// link or QR code, or all accounts as a JSON or text file.

Privacy

  • Local: Every code is computed in your browser. Your secrets are never uploaded, and no feature in this tool needs an internet connection to work.
  • One-time library download: QR scanning, QR import and QR drawing use two small open-source libraries, loaded once from a public CDN the first time you use a QR feature. That download sends none of your data; after that the tool works offline.
  • Saved accounts: Accounts are stored in your browser’s own storage (IndexedDB) on this device so they survive a refresh. Without the passphrase lock they are stored as plain data, readable by anyone who can use this browser profile. With the lock on they are encrypted with AES-256-GCM using a key derived from your passphrase (PBKDF2-SHA-256), and the passphrase is never stored. There is no recovery if you forget it. Clear all saved accounts deletes everything.
  • Clipboard: Copying a code puts it on your system clipboard like any copied text. For extra care, the Clipboard Secret Auto-Purger can clear it after a countdown.

Limitations

  • Time-based (TOTP) codes only. Counter-based HOTP accounts are not supported.
  • Some authenticator apps, including older versions of Google Authenticator, ignore the hash, digit and period settings and always use SHA-1, 6 digits and 30 seconds. If you create a secret with other settings, test it with the app you plan to use.
  • Camera scanning needs a secure (HTTPS) page and your permission. When the tool is shown inside another website’s page, that page has to allow camera access; if it does not, drop or paste a QR image instead.
  • Browser storage can be cleared by the browser or by you (for example “clear site data”) and does not sync between devices. Keep an exported backup of anything you cannot afford to lose.
  • A phone or browser that has a wrong clock will produce codes the service rejects. Use the clock offset and the Verify box to diagnose it.

FAQ

Is it safe to enter my 2FA secret on a website?

Only if the site truly keeps it local, and you should apply that test to any tool. Here the code runs entirely in your browser: secrets are not sent anywhere, and the page keeps working with the network disconnected after the QR libraries have loaded once. You can confirm this in your browser’s network panel. That said, the secret is the key to your second factor, so for your most important accounts consider keeping it only in a dedicated authenticator app or hardware key and using this tool for testing, backup and development.

Why does the code not work on the website?

Almost always the clock. TOTP depends on both sides agreeing on the time to within one period. Open Details → Verify a code, type the code the service expects, and see which window it falls in. If it is a step or two off, apply the suggested clock offset. If there is no match at all, check the secret, hash, digits and period. A wrong hash or digit count is the usual cause for non-standard setups.

Can I import my accounts from Google Authenticator?

Yes. In Google Authenticator choose “Export accounts”, then drop or paste a screenshot of that QR code here, scan it with the camera, or paste its otpauth-migration:// link. All time-based accounts in it are imported. Counter-based (HOTP) entries are skipped and listed. If the export spans several QR codes, import each one.

What is the difference between SHA-1, SHA-256 and SHA-512?

They are the hash algorithms behind the HMAC. SHA-1 is the long-standing default and is what almost every service and app uses, so it is the safe choice for compatibility. SHA-256 and SHA-512 are part of the standard but are only honoured by some apps and services. Use them only if your service explicitly specifies them.

Does Steam Guard work?

Yes. Choose Steam Guard under Advanced when adding the account. Paste the shared_secret as either Base32 or Base64 and the tool produces the five-character codes. The tool only generates codes; it does not log in to Steam or confirm trades.

Will my accounts still be here after I refresh or close the tab?

Yes. Accounts are saved in this browser on every change and restored on load. If you turned on the passphrase lock you enter it first. They are specific to this browser on this device, so use Export backup to move them or to keep a safety copy.