Disclaimer
This website is for educational purposes only. It exists to demonstrate how the RFC 6238 Time-based One-Time Password (TOTP) algorithm works and to give developers, students, and security-curious users a transparent way to inspect it in their browser.
Educational use only
2FA auth is published as a learning resource. Nothing on this site constitutes security, legal, or professional advice. The tool is not a replacement for a vetted authenticator application (such as Google Authenticator, Authy, 1Password, or a hardware security key) for accounts that matter to you.
No guarantees
The codes generated by 2FA auth are produced entirely in your browser from the secret key you paste. We do not guarantee that any specific code will be accepted by any specific service, nor that the tool is free from bugs or interruptions.
Use at your own risk
You are solely responsible for how you use 2FA auth, including the safekeeping of your TOTP secret keys and the security of the accounts they protect. The operators of this site accept no liability for any loss, damage, or account lockout that results from using — or being unable to use — the tool.
No affiliation
2FA auth is an independent educational project. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Authy, 1Password, or any other authenticator vendor or online service mentioned on this site. All trademarks belong to their respective owners.
Not legal or security advice
If you need to secure production systems, sensitive personal accounts, or anything subject to regulatory requirements, consult a qualified security professional and use a hardened, audited authenticator solution.
Last updated: June 26, 2026