Create a standard TOTP secret and get a QR code to scan into your authenticator app. The secret, QR code, and live code are all generated and verified entirely in your browser — never sent anywhere.
Standard TOTP (RFC 6238)
Uses the same SHA-1-based algorithm as Google Authenticator, Authy, and every major authenticator app — the code generated here will match what your phone shows.
Instant QR Setup
Scan the generated QR code directly into your authenticator app instead of typing a long secret by hand — drawn entirely client-side with no external requests.
100% Private
Secret generation, QR rendering, and code computation all happen in your browser using the Web Crypto API. Nothing is transmitted, stored, or logged — closing the tab discards everything.
What's actually happening when you scan this code
TOTP doesn't send a code anywhere to be checked. Your authenticator app and the service you're logging into both already hold the same secret key — the one this tool generates and encodes into the QR code — and each independently combines that key with the current time, in 30-second steps, through an HMAC-SHA1 hash to arrive at the same 6-digit code. That's why it still works with your phone in airplane mode: no network round-trip is needed, just a synchronized clock (see RFC 6238 in Sources below).
It's also why the shared secret deserves the same protection as a password: anyone who scans your QR code or copies your setup key can generate valid codes for your account indefinitely, exactly as if they'd stolen your password. Save the backup/recovery codes your service offers when you turn on 2FA, and never send your QR code or secret to anyone who asks for it — a real support agent will never need it.
Where this tool's guidance comes from
This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source.