The Complete Guide to Two-Factor Authentication (2FA)
Everything you need to know about 2FA, TOTP codes, authenticator apps, and how to keep your online accounts safe with two-factor authentication.
How to Generate a 2FA Code in 3 Simple Steps
-
1
Copy Your 2FA Secret Key
When enabling two-factor authentication on Google, Facebook, GitHub, or any service, copy the Base32 secret key shown next to the QR code.
-
2
Paste Key & Generate TOTP
Paste the secret key into the 2FA generator field above and click Generate Code. A fresh 6-digit TOTP code is computed instantly in your browser.
-
3
Use the 2FA Code to Log In
Enter the 6-digit verification code into the login form before the 30-second timer expires. The code refreshes automatically for each new login.
Popular Services That Support Our 2FA Generator
Our 2FA code generator is fully compatible with any service that follows the RFC 6238 TOTP standard. Here are the most popular platforms where you can use this authenticator:
Why Use Our Free 2FA TOTP Generator
100% Private & Local
All TOTP code generation happens right in your browser. Your 2FA secret key is never sent to any server, keeping your authenticator data fully private.
Instant 6-Digit Codes
Generate time-based one-time passwords instantly with automatic 30-second refresh. Works as a full replacement for Google Authenticator, Authy, and Microsoft Authenticator.
Built-in QR Code Scanner
Scan any 2FA QR code with your camera or upload an image. The tool reads the otpauth URI automatically so you can skip typing the Base32 secret key.
TOTP & HOTP Modes
Switch between time-based (TOTP / RFC 6238) and counter-based (HOTP / RFC 4226) one-time password algorithms. Supports SHA-1, SHA-256, and SHA-512 hashes.
Frequently Asked Questions About 2FA
What is 2FA (two-factor authentication)?
Is this 2FA generator compatible with Google Authenticator?
Why does my 2FA code change every 30 seconds?
Is it safe to enter my 2FA secret key on this website?
What is the difference between TOTP and HOTP?
Can I use this as my main authenticator app?
What if my 2FA code is rejected by the website?
Does this 2FA tool work offline?
Why Two-Factor Authentication Matters in 2026
Passwords alone are no longer enough. Billions of credentials leak in data breaches every year, and sophisticated phishing kits can defeat even complex passwords. Two-factor authentication โ also called 2FA, multi-factor authentication (MFA), or two-step verification โ adds a second layer that a remote attacker cannot easily bypass.
A TOTP authenticator like this one is the most widely supported 2FA method, working on Google, Microsoft, Apple ID, GitHub, Facebook, Instagram, Snapchat, TikTok, Steam, Epic Games, Fortnite, Discord, and virtually every major online service. With a fresh 6-digit 2FA code rotating every 30 seconds, compromised passwords become useless on their own.
Enable 2FA everywhere you can โ email, social media, cryptocurrency exchanges, cloud storage, banking, and gaming accounts. Combined with a strong password manager and unique passwords per site, a properly configured two-factor authentication setup is one of the single biggest upgrades you can make to your online security.
Types of 2FA Methods Compared: SMS, TOTP, Hardware Keys, Biometrics
There are several different types of two-factor authentication available today, each with different security levels and convenience trade-offs. Understanding these options helps you pick the right 2FA method for each account โ from casual gaming logins to high-value banking and cryptocurrency accounts. Below we compare every major form of 2FA you will encounter in 2026, with honest pros, cons, and our recommendation for each.
| 2FA Method | Security | Convenience | Best For |
|---|---|---|---|
| SMS 2FA | Low | High | Fallback only; vulnerable to SIM swap |
| TOTP Authenticator App | High | High | Daily 2FA for all accounts |
| Push Notifications | Medium | Very High | Work accounts with managed devices |
| Hardware Security Key | Very High | Medium | Email, password manager, crypto |
| Biometric / Passkey | Very High | Very High | Modern passwordless sign-in |
| Backup Codes | Medium | One-time | Recovery when authenticator is lost |
SMS-based 2FA is the most common form of two-factor authentication because it works with any phone. After entering your password, a text message with a 6-digit verification code is sent to your registered number. While convenient, SMS 2FA is vulnerable to SIM swapping attacks โ criminals trick carriers into porting your number to their device. NIST has deprecated SMS as a secure 2FA method for high-value accounts, and major banks increasingly recommend moving to TOTP authenticator apps instead.
Authenticator apps (TOTP) like Google Authenticator, Microsoft Authenticator, Authy, and 1Password generate time-based one-time passwords right on your device without needing any network connection. This makes TOTP 2FA faster, safer, and immune to SIM swap attacks. The codes rotate every 30 seconds based on the RFC 6238 standard, and the same secret key works across every compatible authenticator โ including this browser-based generator.
Hardware security keys such as YubiKey, Google Titan, SoloKeys, and Feitian use the FIDO2 / WebAuthn standard to prove physical possession through a USB, NFC, or Bluetooth device. Hardware keys are the gold standard for 2FA security because they are phishing-resistant โ a fake login page cannot harvest the cryptographic signature, unlike TOTP codes. Use hardware keys for your most critical accounts: primary email, password manager, cryptocurrency exchanges, and work identity.
Push notification 2FA apps like Duo Mobile, Microsoft Authenticator push prompts, and Okta Verify send a confirmation tap to your phone. This is more convenient than typing a 6-digit 2FA code but requires the service to support push and is vulnerable to "MFA fatigue" attacks where criminals spam approval requests hoping you tap Approve by mistake.
Biometric 2FA and passkeys use fingerprint or face recognition, often combined with a passkey bound to your device. Apple Face ID, Windows Hello, and Android fingerprint scanners are increasingly used as the second factor for signed-in devices. Passkeys built on FIDO2 / WebAuthn are gradually replacing both passwords and TOTP 2FA on Google, Apple, Microsoft, GitHub, and a growing list of services โ this is the future of authentication.
Our recommendation: use a TOTP authenticator app as your primary 2FA method, backed by hardware security keys for your most critical accounts (primary email, password manager, cryptocurrency, work identity). Avoid SMS 2FA where possible and always save your backup codes offline in a safe place.
How to Enable 2FA on Popular Services (Step-by-Step)
Setting up two-factor authentication varies slightly across platforms, but the core flow is similar on every major service. Below are quick step-by-step guides for enabling 2FA on the most popular platforms, all of which work seamlessly with this TOTP generator.
Enable 2FA on Google / Gmail
Visit myaccount.google.com โ Security โ 2-Step Verification โ Get Started. Sign in with your password, then pick Authenticator app. Google displays a QR code โ scan it with our TOTP generator or paste the Base32 secret key. Google also supports Google Prompt push notifications and hardware security keys as additional 2FA methods for your Gmail and Google account.
Enable 2FA on Facebook / Meta
Click your Facebook profile picture โ Settings & Privacy โ Settings โ Accounts Center โ Password and security โ Two-factor authentication. Choose Authentication app and scan the QR code or copy the secret key into our 2FA code generator. Facebook lets you add SMS as a backup, but authenticator app 2FA is strongly preferred for better security.
Enable 2FA on Discord
Open Discord โ User Settings (gear icon) โ My Account โ Enable Two-Factor Auth. Enter your password, then use the displayed QR code or manual Base32 key with our 2FA code generator. Always save the Discord backup codes immediately โ if you lose access to your authenticator, Discord requires those codes for account recovery.
Enable 2FA on GitHub
Go to Settings โ Password and authentication โ Two-factor authentication โ Enable. Choose "Set up using an app" to generate TOTP codes with our 2FA tool or any RFC 6238 authenticator. GitHub also supports FIDO2 security keys as an additional factor, and requires 2FA for all contributors on sensitive repositories.
Enable 2FA on Microsoft / Outlook
Visit account.microsoft.com โ Security โ Advanced security options โ Two-step verification โ Turn on. Microsoft prefers its own Microsoft Authenticator app but any RFC 6238 TOTP generator โ including ours โ works identically. The same 2FA setup covers Outlook, Xbox, Microsoft 365, Teams, OneDrive, and all other Microsoft services.
Enable 2FA on Fortnite / Epic Games
Visit epicgames.com/account/password-and-security โ Two-factor authentication โ Enable Authenticator App. Scan the QR code with our 2FA generator. Enabling 2FA on Fortnite also rewards you with the Boogiedown emote and improves security for your Rocket League and Epic Games Store account.
Enable 2FA on Binance / Coinbase / Kraken
Every major cryptocurrency exchange โ Binance, Coinbase, Kraken, Gemini, KuCoin, Bitstamp โ requires 2FA for withdrawals. Enable Google Authenticator compatibility under the security tab of each exchange and save the secret key in a password manager. Losing 2FA access to a crypto account without backup codes can permanently lock you out of your funds.
Enable 2FA on Instagram / TikTok / Snapchat
Instagram, TikTok, and Snapchat all support authenticator-app 2FA through their Settings โ Security menus. Each generates a QR code compatible with any RFC 6238 TOTP tool. Given how often social accounts are targeted for account takeover and resale, enabling two-factor authentication on every social media account is essential in 2026.
After enabling 2FA on any service, test it immediately by logging out and back in โ before you need it for real. This confirms your authenticator codes work correctly and that you have saved the backup recovery codes safely.
2FA Security Best Practices Every User Should Follow
Enabling two-factor authentication is only half the job. Following these best practices keeps your 2FA setup secure against the modern threats targeting authenticator apps, SMS codes, and recovery flows. Adopting even half of the practices below will put you ahead of 95% of users in terms of 2FA hygiene.
-
Always save your backup codes. Every service that supports 2FA generates 8โ10 single-use recovery codes when you enable the authenticator. Print them, save them in a password manager, or store them in an encrypted note. Without backup codes, losing your phone can mean losing the account permanently โ no customer support can help you recover a hardened 2FA account without proof of identity.
-
Use multiple authenticator devices. Export your 2FA backup from this tool and import it on a second device, or use Authy / 1Password which sync TOTP secrets natively across devices. Google Authenticator now has an official export QR feature. Having a second device means a lost or broken phone does not cut you off from every 2FA-protected account at the worst moment.
-
Beware of MFA fatigue attacks. Attackers who know your password may spam you with push notification 2FA requests hoping you tap Approve out of habit or annoyance. This has been used in high-profile breaches at Uber and others. Always check which app is requesting confirmation and deny any unexpected prompts โ legitimate logins rarely trigger unprompted 2FA requests in the middle of the night.
-
Guard against SIM swapping. Even if you avoid SMS 2FA, your phone number is often tied to account recovery flows. Ask your carrier to add a PIN or port-out protection to your account so criminals cannot transfer your SIM to their device. This single change blocks most SIM swap attacks and is free at every major carrier.
-
Combine 2FA with a password manager. A strong, unique password per site plus TOTP 2FA plus hardware security keys for critical accounts is the gold standard of account security in 2026. 1Password, Bitwarden, LastPass, and KeePass can store TOTP secrets alongside passwords โ some even autofill both fields at once for a seamless login experience.
-
Never share 2FA codes, even with support. No legitimate company, bank, or online platform will ever ask you to read your 6-digit 2FA code aloud, type it into chat, or send it by email. If someone does โ whether they claim to be tech support, your bank, or a delivery driver โ it is a scam. Hang up and contact the company through their official phone number or website directly.
-
Audit your 2FA setup yearly. List every account where you have enabled two-factor authentication. Remove 2FA from accounts you no longer use, enable it on new ones you have created, and verify your backup codes still work. An annual 2FA audit catches stale recovery email addresses, old phone numbers on file, and forgotten authenticator seeds.
-
Upgrade to passkeys where available. FIDO2 / WebAuthn passkeys are gradually replacing both passwords and TOTP 2FA on Google, Apple, Microsoft, GitHub, PayPal, and hundreds of other services. Passkeys are phishing-resistant by design and bound to your device secure enclave โ when a site offers passkeys, turn them on instead of relying on 2FA codes alone.
Troubleshooting Common 2FA Problems
Even a well-configured two-factor authentication setup can run into hiccups. Here are the most common 2FA issues users face and practical fixes that resolve the majority of them without needing to contact support.
"Invalid 2FA code" or "Incorrect verification code"
The most common cause is device clock drift. TOTP relies on accurate time โ even a 30-second offset causes codes to mismatch. On Android: Settings โ System โ Date & time โ Set time automatically. On iOS: Settings โ General โ Date & Time โ Set Automatically. On Windows: Settings โ Time & language โ Date & time โ Set time automatically. Servers usually accept codes within a ยฑ1 window, so trying the next code after a 30-second refresh often works.
Secret key typos during manual entry
Base32 uses only AโZ and 2โ7 โ no 0, 1, 8, or 9. Ambiguous characters like O vs 0 or I vs 1 break everything. Copy the secret key directly from the service QR code rather than typing it manually, or use our built-in QR scanner. Many services also let you reveal the plaintext secret alongside the QR code for easier manual entry.
Lost phone with authenticator app
First, try your backup codes โ most services ask for one when you cannot access your 2FA authenticator. If you exported or synced your TOTP secrets, restore them on a new device. As a last resort, contact the service support team and follow their account recovery flow, which usually involves government ID verification or confirming other secrets. Never pay a third-party "2FA recovery service" โ they are scams.
QR code will not scan
Lighting, camera focus, and screen glare are common causes. Try downloading the QR as an image file and uploading it to our image scanner, or manually enter the displayed Base32 secret key. Make sure no browser extension is modifying the QR display.
Account completely locked out of 2FA
Most services support identity verification through government ID, credit card last-4, recovery email, or trusted contacts. Social logins (Google, Apple, Microsoft) can often unlock via the parent account 2FA. Crypto exchanges are the strictest โ expect a multi-day KYC process. Document your identity properly and follow each service official recovery flow.
Push notifications not arriving
Ensure the authenticator app has notification permissions, battery optimization is disabled specifically for it, and the device has active internet access. On Android, some aggressive battery savers kill background authenticator services โ whitelist your 2FA app. Restarting the app usually refreshes the push token.
How TOTP Works Under the Hood (Technical Deep Dive)
For the technically curious, here is exactly how a TOTP 2FA code is generated step by step, following RFC 6238 โ the same algorithm our 2FA generator uses internally, and the same algorithm Google Authenticator, Microsoft Authenticator, Authy, and every other compatible authenticator follows.
- 1. Shared secret. When you enable 2FA on a service, both the server and your authenticator app agree on a random secret key, typically 160 bits (20 bytes) encoded in Base32 for human-readable display. This shared secret never leaves either side under normal operation.
- 2. Time counter. Take the current Unix timestamp, divide by 30, floor the result. This produces an integer counter that both sides increment every 30 seconds. Using time as the counter means no state synchronization is needed between server and authenticator โ both sides independently compute the same value.
- 3. HMAC-SHA1. Compute an HMAC-SHA1 hash using the shared secret as the key and the 8-byte big-endian counter as the message. Output is 20 bytes of cryptographic hash. Modern implementations also support HMAC-SHA256 and HMAC-SHA512 for stronger 2FA when both sides agree on the algorithm.
- 4. Dynamic truncation. Take the last byte of the hash, mask the low 4 bits to get an offset (0 to 15). Extract 4 bytes from that offset in the hash, clear the high bit, and treat the result as a 32-bit integer. This is the dynamic truncation algorithm from RFC 4226 (HOTP) that TOTP builds on top of.
- 5. Modulo for digits. Compute the 32-bit integer modulo 10^digits โ typically 10^6 for standard 6-digit 2FA codes, or 10^8 for some banking services. Pad with leading zeros if necessary so a low-value output like 7 becomes 000007 rather than a partial code.
The result is a 6-digit verification code that both your authenticator and the server compute identically. When you type the code during login, the server computes the expected code for the current time window and compares. Because HMAC is collision-resistant, only someone holding the shared secret can produce a valid TOTP code โ that is the cryptographic math behind modern 2FA security. In our implementation, this entire computation happens client-side using the browser Web Crypto API, so your secret key never touches a server and our generated codes match Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and every other RFC 6238 compliant authenticator exactly.
Two-Factor Authentication Glossary
A quick reference for the most common two-factor authentication terminology you will encounter when enabling 2FA across different services.
- 2FA
- Two-Factor Authentication. Requires two different authentication factors before granting account access.
- MFA
- Multi-Factor Authentication. Umbrella term covering any use of multiple factors (2FA is the most common form of MFA).
- TOTP
- Time-based One-Time Password. 6-digit 2FA codes that change every 30 seconds. Defined by RFC 6238.
- HOTP
- HMAC-based One-Time Password. Counter-based 2FA codes that increment on each use. Defined by RFC 4226.
- OTP
- One-Time Password. Any code valid for a single login attempt. Includes both TOTP and HOTP variants.
- HMAC
- Hash-based Message Authentication Code. The cryptographic primitive that underpins both TOTP and HOTP.
- Base32
- The text encoding used for 2FA secret keys โ only AโZ and 2โ7, chosen to avoid ambiguous characters.
- Authenticator
- Any app or device that generates 2FA codes. Examples: Google Authenticator, Authy, 1Password, Microsoft Authenticator.
- QR Code
- Quick Response barcode containing the otpauth:// URI used to provision a new 2FA secret without typing.
- Secret Key
- The shared cryptographic key between you and the service, usually 160 bits encoded in Base32.
- Recovery Codes
- Single-use backup codes to log in when your authenticator is unavailable. Also called backup codes.
- SIM Swap
- Attack where criminals port your phone number to their SIM card to intercept SMS 2FA codes.
- Passkey
- Modern FIDO2 / WebAuthn credential replacing passwords plus 2FA on a growing list of sites.
- FIDO2
- Open authentication standard for phishing-resistant login using hardware keys or device biometrics.
- WebAuthn
- Web API that implements FIDO2 inside the browser for passkey and hardware key sign-in.
- U2F
- Universal 2nd Factor. The predecessor of FIDO2, still supported by many hardware security keys.
- YubiKey
- Popular brand of hardware security key supporting FIDO2, U2F, OTP, and smart card functions.
- Phishing-resistant MFA
- 2FA methods (hardware keys, passkeys) that cannot be tricked by fake login pages.
