One field, one live token
Paste a secret key or the whole otpauth:// link and the matching code starts counting down immediately — no setup, no forms, no “add account” ceremony.
Timer
Keys used this session
Private by design. Codes are generated in your browser with Web Crypto. Your key and the generated codes exist only in this page’s memory — nothing is written to browser storage (localStorage, cookies, or any other store), and everything is gone when you refresh or close the page.
100% client-side · zero-knowledge
Free 2FA Authenticator & Code Generator
Paste a secret key, get a live 6-digit code. A fast, free, private alternative to Google Authenticator, Authy, and Microsoft Authenticator — for times when your phone is gone, broken, or simply out of reach.
No app. No account. No key ever touches a server.
otp.rfc-6238.js
// The whole tool. No servers involved.
const step = Math.floor(Date.now() / 1000 / 30);
const key = await crypto.subtle.importKey(
'raw', base32(secret), { name: 'HMAC', hash: 'SHA-1' });
const mac = new Uint8Array(
await crypto.subtle.sign('HMAC', key, u64(step)));
const o = mac[19] & 15;
const code = ((mac[o] & 0x7f) << 24 | mac[o+1] << 16
| mac[o+2] << 8 | mac[o+3]) % 1e6;
code.toString().padStart(6, '0'); // ← your 2FA code
0
keys stored on our side — there are no servers to store them
100%
of the computation happens on your device, via Web Crypto
6238
the RFC standard implemented — compatible with every authenticator app
How it works
Three steps to a live 2FA code — no phone needed.
Two-factor authentication adds a second lock to your accounts: a code that changes every 30 seconds and is derived from a shared secret plus the current time (TOTP — RFC 6238). This page is the second lock. Your browser runs the exact same counter as the website you’re logging into.
Because the secret itself is the only thing that matters, you can keep it in an encrypted password manager and regenerate codes anywhere — a laptop, a second browser profile, a field laptop, offline.
New to the topic? Read the plain-English explainer: What is 2FA? How TOTP works
Try it now- 01
Grab your secret key
When a service offers “two-factor authentication → authenticator app”, pick “can’t scan? show setup key”. You’ll get a Base32 string like JBSWY3DPEHPK3PXP — or a whole otpauth:// link. Both work here.
- 02
Paste, drop, or scan it
Paste the key or URI into the generator, drop a screenshot of the QR code onto the page, or scan with your camera. Everything is decoded on your device — nothing is uploaded.
- 03
Copy the live code
A fresh token appears within seconds, synced to your device’s clock. Click copy and complete your login. It refreshes automatically every 30 seconds.
Features
Everything a 2FA app does — and much of it better
Paste a screenshot, get a key
Ctrl+V an image of the QR code, drop an image file, or scan with your webcam. Three ways to import, zero ways for your key to leak.
Full parameter support, auto-detected
A bare key uses the standard defaults; a full otpauth:// URI honors every parameter it carries — 6/7/8 digits, 15/30/60 s period, SHA-1/256/512, even counter-based HOTP.
In-memory only — nothing saved
Your key never touches any persistent storage: no localStorage, no cookies, no device cache. The Recent-keys list speeds up switching within a visit, but a refresh or tab close wipes everything — every visit starts blank.
Nothing to install or sign up for
No phone app, no account, no sync fees, no ad tracking. If you can open a browser, you can generate a code.
Offline & installable
Works with the tab closed to the world — literally. And as a PWA it installs into your dock or home screen like a native app.
Compatibility
Works wherever an authenticator app works
Any service with a “use an authenticator app” option generates the same standard TOTP code — including the ones below:
- Discord
- GitHub
- Steam
- Binance
- X / Twitter
- AWS
- Coinbase
- Kraken
- Twitch
- Microsoft
- Proton Mail
Setting up one of these? Read the step-by-step guide: GoogleMicrosoftDiscordGitHubXAWSCoinbaseKrakenSteamBinance
About this 2FA tool
2FA COUNTER — the 2FA authenticator that lives in your browser
Reviewed by the 2FA COUNTER security editorial team · our editorial methodology
People arrive here with the same want: a working authentication code, right now, without installing anything. That is exactly what 2FA COUNTER is. It is a free, browser-based 2FA authenticator and code generator: paste your secret key, drop a screenshot of the QR code, or scan it with your camera, and the matching live code appears within seconds and refreshes itself every 30 seconds, exactly like the app on your phone — only nothing has to be installed.
What is 2FA? The 60-second answer
2FA — two-factor authentication — is the second lock on your account: something youhave, in addition to something you know. When you switch it on, a service hands you a one-time shared secret. Your authenticator then derives a fresh 6-digit code from that secret plus the current time — the TOTP standard, RFC 6238 — while the site you are logging into runs the identical calculation and compares results. Because the code rotates every 30 seconds, a stolen password by itself no longer opens anything. If you want the full cryptography walkthrough, read the plain-English explainer What is 2FA? How two-factor authentication & TOTP work, then come back and generate your first code.
How to get a code in three steps
Whenever you need a code for a login, three inputs are enough. First, enable two-factor on the website and choose “authenticator app”; when you cannot scan the QR code, reveal the setup key — a Base32 string or the complete otpauth:// link. Second, paste that key or URI into the generator at the top of this page, drop in a QR screenshot, or use your camera. Third, copy the fresh code and complete your sign-in. The generator honors every otpauth parameter it is given: 6, 7 or 8-digit codes, 15/30/60-second periods, SHA-1, SHA-256 or SHA-512 hashing, and counter-based HOTP. Nothing is uploaded and nothing is logged — the code is computed on your device, and you can verify it yourself in the browser’s network tab.
A 2FA authenticator that never needs your phone
Most people arrive here because their phone left — sold, broken, drowned, wiped, or dead battery on a travel day — and Google Authenticator, Authy and Microsoft Authenticator live only on that device. A browser 2FA tool removes that single point of failure: the secret stays in your password-manager vault, and the code can be regenerated on any computer you trust. If you are weighing the switch, we compare your options honestly, app by app: Google Authenticator vs a browser 2FA generator and Authy vs a browser 2FA generator. It also fits desktop workflows — signing into GitHub or an AWS console on a second monitor, managing multiple accounts through the Recent-keys list, working on a machine where phones are not allowed — and we cover that use on its own page: the authenticator app for PC, without emulation. Install it as an app and the generator keeps working with the network entirely switched off. It is the same RFC 6238 math every service already accepts, just untethered from your pocket.
One tool across crypto, cloud, gaming and social
Whatever you are protecting, standard TOTP is the shared language. Trading on Binance, Coinbase or Kraken, locking down AWS, Microsoft or Google accounts, protecting Steam, Discord, X or your inbox — any service that offers “use an authenticator app” speaks the same protocol, so one tool covers all of them. When a site rejects your code, it is nearly always the device clock, not the tool: set your system time to sync automatically and the codes line up again. For the popular services we publish step-by-step setup guides that pair with this generator, from enabling the feature to pasting the final code.
Nothing sent, nothing stored, nothing to pay
This is one of the very few 2FA tools with nothing to hide, because there is nothing that could be hidden. There are no servers to send keys to, no accounts to create, no premium tier, no ad tracking. Every code is computed locally with the Web Crypto API; your key and a short Recent-keys list live only in the open page’s memory — never in browser storage — and everything is wiped by a refresh or a tab close. Keep the master copy of every secret in an encrypted password manager, save each service’s recovery codes as well, and treat any urgent request for a fresh code as the red flag that it is.
Ready when you are: the generator is at the top of the page. Paste a key and watch the live code count down — free, private, offline-capable. No catch.
FAQ
Questions, answered plainly
Still unsure? Everything this tool does is visible in your browser’s DevTools network tab: zero requests carry your key.
How to get 2FA?
The fastest route is the one this page was built for: in your account's security settings, choose the authenticator-app option and click "can't scan?" when the QR appears — that reveals the setup key. Paste the key into the generator at the top of this page and a working code appears immediately; enter it once to finish setup, then store the recovery codes the service offers. The full walkthrough, including phone-free routes, is in our how-to-get-2fa-code guide.
How to enable 2FA?
Once per account, in its security settings: pick "Two-factor authentication", choose the authenticator-app method over SMS where you have the choice, and confirm with a live code from your authenticator. The exact menu path differs per service — which is why we publish step-by-step guides for Google, GitHub, Discord, Binance and others. This generator works with every one of them.
How does 2FA work?
Short version: your password proves you know the account, and a time-limited code proves you hold its secret. This generator computes the standard TOTP code (RFC 6238) right in your browser — shared secret plus the current time, refreshed every 30 seconds — the same calculation a phone app would do. The full mechanism, step by step, is explained in our "What is 2FA?" guide.
What is 2FA used for?
Start with the logins you could least afford to lose: your email (it resets everything else), banking and brokerage, crypto exchanges, your code hosting, your gaming and social accounts — then work outward. Our per-service guides cover the most common ones: Google, GitHub, Discord, Binance and more.
Is 2FA 100% safe?
No — and a tool that claimed otherwise would be lying to you. A code can still be phished if you type it into a fake site within its 30-second window, and malware already on your device is beyond any authenticator's reach. What this generator does remove is the interception risk: the code is computed on your device and never crosses any network.
Is 2FA compulsory?
Not by law — but increasingly by lockdown: GitHub requires it for code contributors, banks and crypto exchanges force it on, and many employers mandate it for work logins. Check the accounts that matter most to you, and treat your email as compulsory regardless: whoever controls your inbox can reset everything else.
Why is 2FA so important?
Because it is the one upgrade that survives a password leak. Microsoft reports that 2FA blocks over 99.9% of account compromise attacks — and with the generator at the top of this page, enabling it costs about two minutes per account.
How strong is 2FA?
It comes down to the second factor: SMS is the weakest (SIM swaps), TOTP codes — the kind this generator produces — are computationally strong and never transmitted, and hardware keys or passkeys are strongest of all. You are in the strong tier here; our TOTP vs passkeys comparison covers the strongest option.
Why does everything use 2FA now?
Password-only security collapsed at scale: mass breaches, cheap automated credential stuffing, and regulators stepping in — NIST restricts SMS-based authentication in US standards, and the EU's PSD2 mandates strong customer authentication. Once a few giants made 2FA normal, every other service followed. The upside for you: every major service now supports the app-based method this generator uses.
Do I need a phone to use this 2FA authenticator?
No. This is a browser-based 2FA tool: it runs on any laptop, tablet, or desktop with a modern browser, online or fully offline once installed as an app. It replaces the phone app whenever a phone is lost, sold, broken, out of battery — or simply not allowed where you work.
Is 2FA COUNTER safe to use?
Yes. Every calculation happens locally in your browser with the Web Crypto API. Your secret keys are never sent to — or seen by — any server. You can load the page, disconnect from the internet, and the generator keeps working.
Can I use this offline?
Absolutely. Install 2FA COUNTER as an app (Add to Home Screen / Install) and it runs completely offline like a native authenticator. Codes are derived from your secret plus your device clock — no network needed.
Why is my 2FA code being rejected?
Almost always clock drift. TOTP codes are time-based, so if your device clock is off by even half a minute the code is invalid. Make sure your system time is set to sync automatically (e.g. Windows “Sync now” in date & time settings, macOS “Set date & time automatically”) and try again. The generator computes against the time your device reports — it has no clock of its own to fix.
How is this different from Google Authenticator or Authy?
They are phone apps; this is a browser authenticator. It uses the exact same RFC 6238 TOTP algorithm and works with every service that accepts a standard authenticator app — but you never lose access because a phone is broken, sold, or out of battery.
Where are my keys stored?
Nowhere. Your key lives only in the input field for as long as the page is open — it is never written to localStorage, cookies, or any other browser storage, and never leaves your device (there are no servers to send it to). Refreshing or closing the page wipes the key, the code, and the recent-keys list, so every visit starts with a clean, private field. Keep the original secret in your password manager; paste it in each time you need a code.
Does it work with HOTP, 8-digit codes, or SHA-256 services?
Yes. Paste the full otpauth:// URI your service provides and every parameter it carries is honored automatically — 6, 7 or 8 digits, 15/30/60 s period, SHA-1/SHA-256/SHA-512 hashing, and counter-based HOTP. A bare Base32 key uses the standard defaults (6 digits, 30 s, SHA-1), which is what almost every service uses.
Is it really free?
Yes — no accounts, no premium tier, no login. It is a tool, not a service.
No more reaching for your phone
Keep your secrets in your password manager, generate codes right here, and stay signed in on any device — even with no internet at all.
Generate a 2FA code now