Two-Factor Code Generator

How to use it

1. Find the setup key for an account you own. When you turn on two-step verification, most sites offer “Can’t scan the QR code?” or “Enter a key manually”, which shows a code like JBSW Y3DP EHPK 3PXP. Developers can paste the full otpauth://totp/… link instead.
2. Paste it into the box and press Show codes.
3. The current code appears with a countdown ring. It turns red in the last five seconds, and the next code is shown underneath.
4. To test a server or an app, type a code into Check a code. It tells you whether it matches the current, previous or next time step.
5. Press Clear when you’re done. The key is also wiped when you leave the page.

If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi

Please read: keep setup keys secret

A setup key is the secret behind your authenticator app. Anyone who has it can make your codes forever, until you turn two-step verification off and on again. So:

• Only use keys for your own accounts, or for systems you’re building and testing.
• Never paste a key that someone sent you, and never read out or type in a code because a caller, text or email asked you to. Banks, HMRC, Microsoft and delivery firms never ask for these codes. That request is always a scam.
• Don’t save setup keys in plain text, email or screenshots. If you need a backup, keep it in a password manager, or encrypt it with our Text Encrypt and Decrypt tool and store the passphrase separately.
• This page is a handy tool, not a replacement for an authenticator app on your phone. For everyday sign-ins, use an app such as Google Authenticator, Microsoft Authenticator, Authy or your password manager.

When it’s useful

• Developers testing two-factor login on their own website or app, with the option to change algorithm, digits and period.
• Checking a backup key works before you rely on it: if the codes here match your phone app, your saved key is correct.
• Getting back into your own account when your phone is lost or reset, if you saved the setup key when you turned 2FA on.
• Moving to a new authenticator app and confirming the new app shows the same codes.

How the codes are made

These are TOTP codes (time-based one-time passwords), defined in the internet standard RFC 6238. Your device and the website both know the same secret key. Every 30 seconds, each side combines the key with the current time using HMAC-SHA-1 and turns the result into a 6-digit number. Because both use the same key and the same clock, they get the same code without ever talking to each other. That’s also why your device’s clock must be accurate: if it’s more than about 30 seconds out, codes won’t be accepted. The tool shows your device time to help you spot this.

Setup keys are written in base32, which uses only the letters A to Z and the numbers 2 to 7, so spaces and lower case don’t matter. If you type 0, 1 or 8 by mistake, the tool reads them as O, I and B and tells you. An otpauth:// link can also set SHA-256 or SHA-512, 8 digits or a 60-second period, and the tool follows those settings automatically.

Privacy

Codes are calculated in your browser with Web Crypto. The key and codes are never sent to Catpool or anyone else, aren’t stored in your browser, and are wiped from the page when you press Clear, edit the key or leave. The page makes no network requests while it runs.

Frequently asked questions

The code doesn’t work on the website. Why?

Check your device’s time is set automatically. Make sure you copied the whole key with no missing characters, and that the account doesn’t use different settings (most use SHA-1, 6 digits and 30 seconds). Some services use their own systems rather than standard TOTP, such as Steam Guard and some bank apps, and those won’t work here.

Can I scan a QR code here?

Not directly. Most sites show the key as text if you choose “enter manually”. If you only have a QR code, our QR X-Ray can read it and show the otpauth:// link inside.

Is this the same as SMS codes?

No. SMS codes are sent to you by text. TOTP codes are generated on your device from a shared key, which is safer because they can’t be intercepted by SIM-swap fraud.

Does it support HOTP counter codes?

No. It makes time-based codes, which is what nearly every service uses.

Related: Catpool home, Security, Password Generator, QR X-Ray, Text Encrypt and Decrypt, Has My Password Been Leaked?.