Generate Time-based One-Time Passwords (TOTP) in real-time. Paste your Base32 secret to see the current OTP, refreshing every period — compatible with Google Authenticator, Authy, and Microsoft Authenticator.
2FA Live is a real-time TOTP generator that turns one or more Base32 secrets into the same six-digit codes you would see in Google Authenticator, Authy, Microsoft Authenticator, or 1Password. Paste the secrets, click Get OTP, and the page shows each code alongside a countdown ring. Secrets stay in your browser — the HMAC signing runs locally through the Web Crypto API. If you also need to issue a fresh secret for a new account, generate a strong key first.
When your phone is lost, factory reset, or stuck in a slow restore, paste the Base32 backup secret you saved during 2FA enrollment to log back into email, banking, GitHub, or cloud accounts without waiting for support recovery flows.
Ops, finance, and devops teams often share access to billing portals, registrars, or admin dashboards that require 2FA. Storing the Base32 secret in a team password manager and using 2FA Live to generate the code keeps the workflow open to anyone authorised, without binding the account to one person's phone.
Engineers building authentication flows can paste test secrets here to confirm that their server-side TOTP library produces the same code for the same time window. Pair with the JWT debugger when verifying that a TOTP-protected login mints a valid session token.
When you generate an otpauth URL for a new account, paste the URL into 2FA Live to confirm that the algorithm, digits, and period match what the authenticator app expects before issuing the QR to a user. Build the QR image only after the secret produces correct codes.
2FA Live is for people who already have a Base32 secret and need a code right now: account owners with a saved backup, team members sharing access to a service account, security engineers debugging an integration, and anyone moving 2FA between devices. It is not a replacement for using a hardened authenticator app on your daily device.
Anyone with the Base32 secret can produce valid codes. Keep secrets in a trusted password manager, do not paste them into shared screens or chat threads, and rotate the secret if it leaks.
TOTP depends on accurate system time. If 2FA Live's code does not match the service's expectation, check the device clock and time zone before assuming the secret is wrong.
Most services use SHA-1, 6 digits, 30 seconds. Some banks, enterprise SSO, and hardware tokens use SHA-256, SHA-512, or 7-8 digit codes. Match the issuer's parameters in Advanced or the codes will not validate.
A reliable 2FA workflow ties together fresh secret generation, secret-to-QR encoding, real-time verification, and session-token inspection.
Key Generator
Verify the TOTP output here
QR Code Generator
JWT Debugger
No. 2FA Live decodes Base32 and runs HMAC signing locally through the Web Crypto API. The secrets never leave your browser tab and the page does not send them anywhere.
Most often it is a clock drift on one device. As a second check, confirm that algorithm, digit count, and period match the issuer's settings — open Advanced or use an otpauth:// URL to set them precisely.
Letters A-Z and digits 2-7. Padding equals signs are ignored. Spaces, dashes, and lowercase letters are normalised automatically.
Yes. Google Authenticator, Authy, Microsoft Authenticator, and 1Password all use the same TOTP algorithm. With default SHA-1, 6 digits, and a 30-second period, 2FA Live produces the same codes those apps would.
Yes. Paste one secret per line. Each row gets its own current code, period, and countdown. Mixing plain Base32 lines with full otpauth:// URLs in the same input is supported.
This tool focuses on TOTP (time-based). HOTP uses a counter you advance manually and is rare in modern 2FA flows.
One secret per line. Accepted formats: plain Base32 (JBSWY3DPEHPK3PXP), labeled (GitHub: KZXW6YTBOI), or full otpauth:// URL.
These defaults apply to every line. otpauth:// URLs override them per entry.
Secrets stay in your browser. The HMAC signing happens with the Web Crypto API on this device. Nothing is uploaded.