Create a two-factor authentication secret and watch the live 6-digit codes roll over every 30 seconds. Scan the QR code with Google Authenticator, Authy, 1Password or Aegis, or copy the otpauth link. The secret is generated and used entirely in your browser.

Live rolling codes

QR code & otpauth link

SHA-1 / SHA-256 / SHA-512

100% in your browser

Use the tool now Step by Step

Trusted & free

It is completely free, private and requires no signup.

2FA is not optional

Even a leaked password cannot unlock an account protected by a TOTP code.

Prefer app-based codes

Authenticator apps are more resistant to SIM-swap and phishing than SMS codes.

Store the secret safely

Keep backup codes and the otpauth secret somewhere offline and secure.

Check your clock

TOTP depends on time — an out-of-sync device generates wrong codes.

How it works

A random 160-bit Base32 secret is created for you. You can also paste a secret from an existing service.

Open your authenticator app, add an account and scan the code — or copy the otpauth:// link manually.

The 6-digit code refreshes every 30 seconds. Enter it on the service to finish enabling 2FA.

Examples & Data

Algorithm	Digits	Example code
SHA-1	6	492039
SHA-256	6	870214
SHA-512	8	01658690

SHA-1 with 6 digits and a 30-second period is the default used by nearly every service.

All tools

Password Strength Checker

Score any password and estimate crack time

Password Generator

Create strong random passwords up to 128 chars

Random String Generator

Random tokens, IDs and keys with any charset

Passphrase Generator

Memorable multi-word passphrases (Diceware)

TOTP / 2FA Code Generator

Time-based one-time codes and otpauth secrets

Password Breach Checker

Check if a password appeared in known breaches

SHA-256 Generator

Hash text to a 64-char SHA-256 digest

MD5 Generator

Compute the 32-char MD5 checksum of any text

SHA-1 Generator

Generate the 40-char SHA-1 hash of any input

SHA-512 Generator

Hash text to a 128-character SHA-512 digest

HMAC Generator

HMAC-MD5, SHA-1, SHA-256 & SHA-512 with secret key

bcrypt Generator / Checker

Hash passwords with bcrypt and verify hashes

PBKDF2 Key Derivation

Derive keys from a password with salt and iterations

AES Encrypt / Decrypt Text

Encrypt text with AES-256-GCM and a password

File Hash / Checksum

Compute SHA hashes of any file locally

IP Address Checker

Identify IPv4 vs IPv6, public/private and more

IPv4 Calculator

Network, broadcast, hosts, subnet mask & wildcard

IPv6 Calculator

Expand, compress and subnet IPv6 addresses

Subnet Calculator

CIDR ranges, wildcard masks and usable hosts

MAC Address Generator

Random valid MAC addresses, unicast or multicast

Port Checker

Learn what each TCP/UDP port number means

DNS Lookup

Resolve A, AAAA, MX, NS, TXT and CNAME records

WHOIS Lookup

Domain registration, expiry and registrar info

HTTP Header Analyzer

Security, caching & SEO headers explained

User-Agent Parser

Decode browser, OS and device from any UA

MIME Type Lookup

File extension to MIME type reference

HTTP Status Code Lookup

Every status code 1xx–5xx explained

URL Encoder / Decoder

Percent-encode URLs and parse query strings

Color Contrast Checker (WCAG)

Check text contrast against WCAG AA & AAA

UUID / ULID Generator

UUID v4, v7, ULID and NanoID in bulk

JWT Decoder & Signer

Decode, inspect and sign JSON Web Tokens

Base64 Encoder / Decoder

Encode and decode Base64, standard or URL-safe

QR Code Generator

QR codes for links, Wi-Fi and vCards

JSON Formatter & Validator

Format, minify and validate JSON instantly

Unix Timestamp Converter

Convert Unix timestamps to dates and back

Regex Tester

Test regular expressions with live matches

Diff Checker

Compare two texts and highlight differences

Lorem Ipsum Generator

Placeholder paragraphs, sentences or words

Number Base Converter

Convert between binary, octal, decimal and hex

Color Converter (HEX / RGB / HSL)

Convert colors and copy HEX, RGB or HSL

CSV to JSON Converter

Convert CSV to JSON and JSON back to CSV

Case Converter & Slug Generator

camelCase, snake_case, kebab-case, Title & slug

Word & Character Counter

Words, characters, sentences and reading time

Ready to try it?

It is completely free, private and requires no signup.

Use the tool now

100% Free No signup Private & secure

Help Center

Frequently Asked Questions

TOTP (Time-based One-Time Password, RFC 6238) is an algorithm that combines a shared secret with the current time to produce a short code that changes every 30 seconds. It is what most authenticator apps use.

Yes. The secret is created with the browser crypto API and never sent anywhere. To be extra safe, use it for testing or generate on a trusted device, then store the secret securely.

Any standard TOTP app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, Aegis, FreeOTP and others.

TOTP depends on the clock. If your device time is off by more than 30 seconds the codes will not validate — enable automatic time sync and try again.

Bright Coding Network