TOTP Authenticator (2FA)
One-time codes computed in your browser with Web Crypto, verified against the official RFC 6238 test vectors. Your secrets never leave the device.
TOTP codes computed in your browser with Web Crypto. Secrets are stored only on this device.
Add your first account by pasting the otpauth:// URI your service shows when setting up 2FA.
Built by
Miguel Ángel Colorado Marin (MACM)
Built by
Miguel Ángel Colorado Marin (MACM)
Full-Stack Developer · Guadalajara, España
I develop web apps, digital tools and full projects — from design to deployment.
TOTP two-factor auth is the standard used by GitHub, Google, Amazon and virtually every serious service: the server holds a shared secret and both sides compute the same 6-digit code that rotates every 30 seconds per RFC 6238. This tool acts as an authenticator with nothing to install: paste the otpauth:// URI your service shows when setting up the second factor and codes appear instantly, with a countdown ring showing how long each code lives. The cryptographic implementation uses the browser's Web Crypto API and is automatically validated against all 18 official test vectors from the RFC itself — the same list banks use to certify tokens. Accounts are stored in the browser's local storage, protected by your OS: they are never sent to any server.
Features
- ✓Import accounts by pasting the service's otpauth:// URI
- ✓SHA-1, SHA-256 and SHA-512 · 6 or 8 digits · configurable period
- ✓Live countdown ring and one-click copy
- ✓Exportable/importable JSON backup
- ✓Algorithm validated against all 18 official RFC 6238 vectors
How to generate 2FA codes?
- 1
Enable 2FA on your service
When it shows the QR, look for the "can't scan" link that reveals the secret.
- 2
Paste the secret or URI
Accept the full otpauth:// URI or fill in the name and Base32 secret manually.
- 3
Use the code before it rolls over
Click the code to copy it; the ring shows the seconds remaining.
- 4
Keep a backup if you want
Export a JSON with your accounts to migrate them to another device.
Frequently asked questions
Is it safe to keep my 2FA secrets in the browser?
Secrets live in the browser's localStorage, which your OS shields from other apps. The real risk is someone with physical access or malware on your machine — same as any authenticator app. For maximum safety, export the backup, store it encrypted and delete accounts after use.
How do I know the codes are correct?
The implemented algorithm is validated against the 18 test vectors in Appendix B of RFC 6238 — the official document defining TOTP — producing exactly the expected values for SHA-1, SHA-256 and SHA-512. It's the same test battery reference implementations use.
Can I use it offline?
Yes. Once the page loads, code computation is 100% local via Web Crypto: no server is contacted when adding accounts or generating codes. You only need connectivity the first time you load the site.
Related tools
Embed TOTP Authenticator (2FA) on your site
Add TOTP Authenticator (2FA) to any web page with a simple iframe. Free, with attribution to miguelacm.es.
<iframe
src="https://miguelacm.es/embed/totp-generator"
width="100%"
height="700"
frameborder="0"
title="TOTP Authenticator (2FA) — miguelacm.es"
></iframe>