Where do I find the setup key?

On the same screen where the service shows the QR code for its authenticator app. Look for a link like “can’t scan?”, “enter code manually”, or “show setup key”. It reveals a Base32 string (or a full otpauth:// URI) — either works in the generator.

My code is rejected — what now?

It is almost always clock drift. TOTP is time-based, so a device clock that is off by even half a minute produces invalid codes. Set your system time to sync automatically and try again.

Is this the same code my phone app would generate?

Yes. Every authenticator app — Google Authenticator, Authy, Microsoft Authenticator, or this browser tool — computes the same RFC 6238 TOTP code from the same secret and the same clock. They are interchangeable.

Do I still need my recovery codes?

Yes. Store them offline, separately from this tool. If you ever lose access to the device that holds your secret key, recovery codes are the way back into the account.

2FA How-to

How to get your 2FA code

The whole process takes about a minute: reveal the setup key, paste it here, and type the resulting code into whatever screen asked for it. No phone required — the reference implementation of the math is running at the top of our home page generator.

Reviewed by the 2FA COUNTER security editorial team · our editorial methodology

What you need before you start

Account access, obviously — you should already be signed in to the service you want to protect. Beyond that, two things matter. First, the service must offer anauthenticator app option as its second factor; that covers Google, Microsoft, GitHub, Discord, Steam, AWS, Coinbase, Kraken, Binance, X, and most banks and exchanges. Second, you need somewhere to run the authenticator: a phone app, or — the point of this site — this browser tool, which computes the identical codes without installing anything.

A note on naming: services call this second factor “two-factor authentication”, “2FA”, “two-step verification”, “TOTP”, or “authenticator app”. Behind the labels it is the same thing — a time-based, one-time code derived from a shared secret. If you want the mechanism explained rather than used, read What is 2FA? How TOTP works.

Step 1: Turn on 2FA and reveal the setup key

Open your account’s security settings and find the section for two-factor authentication. Choose the authenticator app option. The service displays a QR code for you to scan with a phone — and that screen almost always carries an alternative: a link reading “can’t scan?”, “enter code manually”, or“setup key”. Following that link reveals the actual secret: a Base32 string like JBSWY3DPEHPK3PXP, occasionally wrapped in a full otpauth:// URI that also carries the account label, digit count, refresh period, and hash algorithm.

This key is the credential — it is the movable equivalent of your password for the second factor. Treat the screen like a recovery screen: nobody legitimate will ever ask you to paste a setup key into an email or a chat. Copy it, finish enabling 2FA (most services ask for one working code to confirm), and keep the original somewhere encrypted, like a password manager.

Step 2: Paste the key into the generator

In the generator at the top of our home page, paste what you copied — the bare Base32 string or the full otpauth:// link, both are fine. A live 6-digit code appears within seconds and refreshes every 30 seconds. You can also import the key from an image: paste a screenshot of the QR code directly onto the page with Ctrl+V, drop an image file onto it, or scan the QR code with your camera — decode happens locally, and nothing is uploaded. If the service hands out a nonstandard configuration (8-digit codes, 15/30/60-second periods, SHA-256, or counter-based HOTP), a full otpauth:// URI carries all of those parameters and the generator honors them automatically.

Step 3: Copy the live code and finish sign-in

Type the current code into the verification prompt before it rotates. Each code is valid for one 30-second window (shorter or longer for services with custom periods), so if the badge hits the last few seconds, wait for the next code rather than rushing a stale one. From now on, every sign-in with this service repeats the same loop: open the generator → paste the key → copy the code → paste it in. The key is held only in the open page’s memory — never in browser storage — so keep it in your password manager and paste it back when you need it.

Where to find the setup key on popular services

Each service buries the authenticator option in a slightly different spot, so we publish step-by-step setup guides that pair with this generator — ending with you pasting the key here and finishing the setup. The most requested: Google, Microsoft, Discord, GitHub, Steam, AWS, Coinbase, Kraken, and Binance.

Troubleshooting: what to do when it doesn’t work

The code is rejected. In practice this is nearly always clock drift on the device running the generator. TOTP compares your code against a code derived from the service’s clock; if your system time is off by even half a minute, the two diverge. Set your operating system to sync time automatically (Windows: “Sync now” in date & time settings; macOS: “Set date and time automatically”), then try the next code.

The QR code won’t scan. Use the “can’t scan?” link to reveal the setup key instead — the text key is always more reliable than photographing a screen. If you only have a screenshot, crop it to the QR code itself; heavily compressed or angled shots often fail to decode.

You lost the phone that had the key. That is the exact situation this tool was built for: if you kept the original secret in your password manager — or if you pasted it here while the phone still worked — you can regenerate codes on any computer. No phone, no restore, no support ticket.

Two habits worth forming

Save the service’s recovery codes offline when you enable 2FA; they are the bail-out if you ever lose the device holding the secret. And never treat a live 2FA code as something to share: no support agent, no bank, no exchange ever needs your current code unsolicited. A code is only ever useful within its 30-second window at the login screen you chose.