Open. Paste. Go.
No sign-up, no downloads, no detours.
Just the code you came for.
↗ SMALL TOOL. EXTRA PEACE OF MIND.
Your next code.
Ready to go.
A simple online authenticator. Add your secret key,
get your code, and get on with your day.
01 YOUR SECRET KEY Local only
Your key stays with you.
Codes calculated in this tab. No browser storage.
02 YOUR ONE-TIME CODE
READY WHEN YOU ARE
Your code will appear here
Refreshes automatically. No extra clicks.
Made for your browser.
Pasted keys stay in this tab’s memory.
Clear it or close the tab when you’re done.
Always on time.
Time-based codes update automatically.
Keep your device clock set accurately.
THE SHORT ANSWERS
A few things to know.
What is a TOTP code?
A time-based one-time password is a temporary code calculated from a shared secret and the current time. Many services ask for it after your password as an additional sign-in step.
Where do I find my secret key?
In the service you want to protect, open two-factor authentication setup and choose the option to enter a setup key manually. Treat this key like a password. We cannot retrieve keys from existing accounts.
Why is my code not working?
Check the key and your device’s automatic date and time settings. Match the digits, period, and algorithm to your provider’s setup. Try a fresh code before it expires. SMS codes, push approvals, and recovery codes are not supported.
Does 2FA Go save my secret?
Pasted keys stay in the current tab’s memory. If you open a /KEY link, the key is sent in the page request and may be recorded by your hosting provider or CDN. Use /#key=KEY to keep it out of server requests. It does not use cookies, local storage, analytics, or third-party scripts on the authenticator page. Use a trusted device and keep your provider’s recovery codes somewhere safe.
Can a link generate my code automatically?
Yes. Open /#key=YOUR_SECRET for a link that processes the key in your browser, or /YOUR_SECRET for a path link. Path links send the key to the server and CDN and may appear in their logs. Both formats automatically fill the key and generate a code, then remove the key from the address bar. Only use complete, valid Base32 keys and keep these links private.