Paste a 2FA setup key to generate the current TOTP token
This 2FA token generator turns an existing authenticator setup key into the current time-based verification code. Here, token and code both mean the short TOTP value used by standard two-factor authentication flows that provide a Base32 secret or otpauth URI.
The generator does not submit a typed or pasted setup key to a backend API to calculate the code, and it has no account database for storing secrets. The current key stays in the page state while you use it. For important long-term secrets, use a trusted authenticator app or password manager.
This tool generates the current time-based authenticator code from setup data you already have. It does not create a new account secret, recover a missing key, produce SMS or email codes, or bypass an account's official security flow.
Begin in the account provider's official security settings. For ChatGPT or another service, use this independent tool only when that provider displays a standard Base32 TOTP key or otpauth URI; the tool cannot access or enroll the account for you.
A 2FA token generator usually means the same TOTP workflow: the account provider creates a shared setup key, and the generator calculates the current short-lived code. This tool needs that Base32 key or an otpauth URI; it cannot derive a valid token from an account name alone.
This generator is built for standard TOTP setup keys used by Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, 2FAS, FreeOTP, and many other 2FA or MFA flows. Use it when a service shows a manual setup key, Base32 secret, or otpauth URI.
Most accounts use SHA-1, 6 digits, and a 30-second period. If a code is rejected, check the copied secret, your device time, and whether the service requires 8 digits, SHA-256, SHA-512, or a different period.
For a temporary link, the fragment format keeps the secret after # in the browser. Clean tool and guide pages are indexable, while server-visible path or query URLs containing secrets are returned with noindex and no-store headers.
If a service only shows an authenticator QR code, save or screenshot the QR image and use the QR image button. Supported browsers read the otpauth URI locally with the built-in BarcodeDetector API; unsupported browsers can still use the manual setup key or pasted otpauth text.
A valid 2FA TOTP code requires the shared setup secret from the account security page. The generator cannot invent a code without the setup key, because the service verifies the same secret and time window.
This page calculates software TOTP tokens. It does not emulate a hardware security key, approve a push notification, generate a recovery code, or create a new account setup secret.
In authenticator-based 2FA, token often refers to the software credential or its current numeric output, while code refers to the digits you submit. This page generates that current TOTP code from an existing software-token secret.
The current code is calculated in the browser with the Web Crypto API. Use the fragment URL form for shortcuts when possible, because values after # are not sent in HTTP requests.
Use this matrix to check what this local TOTP/2FA generator can accept and which setting to verify before copying a code.
| Need | Input or setting | What to check | Result |
|---|---|---|---|
| Manual 2FA setup key | Base32 secret with optional spaces, hyphens, or padding | Copy the full key from the account security page | The visible field keeps your pasted format while calculation normalizes it locally |
| otpauth setup link | otpauth://totp/ URI from an authenticator QR code or setup screen | The URI includes a secret parameter and optional issuer, digits, period, and algorithm | The tool reads supported TOTP parameters and updates the generator options |
| Authenticator QR image | QR screenshot or saved image | Browser supports local BarcodeDetector API | The QR is read in the browser; no upload is needed |
| Multiple accounts | One independent generator per secret | Use Add generator only when you need another account or MFA token | Each generator has its own name, secret, countdown, and copy button |
| Advanced TOTP settings | SHA-1, SHA-256, SHA-512; 6 or 8 digits; 10-120 second period | Match the service setup screen if it is not the common 6-digit 30-second default | Codes align with RFC 6238-compatible authenticator apps |
| URL secret shortcut | #secret= fragment, path secret, or ?secret= query | Prefer fragment links because the secret after # is not sent in HTTP requests | Path and query secret pages are served noindex/no-store |
Base32 setup keys, formatted keys with spaces, hyphens, or padding, full otpauth://totp/ setup links, and authenticator QR code images when the browser supports local barcode detection.
Google Authenticator compatible TOTP, Microsoft Authenticator compatible TOTP, 1Password, Bitwarden, 2FAS, FreeOTP, Authy-style setup keys, and similar MFA apps.
SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, 10 to 120 second periods, and the common 30-second authenticator countdown.
Use #secret= for the safest shortcut because URL fragments are not sent in HTTP requests. Path and ?secret= query shortcuts still work and are marked noindex.
The tool generates standard TOTP authenticator codes from a setup secret. It does not create new account secrets, store recovery codes, approve push prompts, or replace account recovery settings.
The page opens with one generator by default. Use it for the first account's TOTP setup key or otpauth URI.
Enter the Base32 secret or otpauth URI for the account. The browser keeps the visible input as typed while normalizing it for calculation.
Use the add button only when you need multiple independent 2FA codes at the same time. Each generator keeps its own secret and settings.
Use the code from the matching generator card before its timer expires. Naming each generator helps avoid mixing accounts.
TOTP means time-based one-time password. An authenticator app and a service share a Base32 secret, then use the current time to create a short code that usually changes every 30 seconds.
The TOTP calculation runs in your browser with Web Crypto. No account is required, and the secret is not submitted to a backend API for code generation. For URL shortcuts, prefer the #secret= fragment format.
The generator does not upload the setup key to a backend API for TOTP calculation or save it in an account database. Typed keys remain in the current page state; avoid path or query secret URLs and use a trusted authenticator app for long-term storage.
The page starts with one generator. Click Add generator for each extra 2FA or MFA secret, optionally rename it, paste a Base32 secret or otpauth URI, then copy the code you need.
Yes. The recommended format is https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECRET. Path shortcuts and ?secret= query URLs also work.
Only when your ChatGPT account's own security settings provide a standard TOTP setup key or otpauth URI. Enable or manage MFA in the official account settings first. This independent tool cannot access the account, recover a missing secret, or approve a push request.
For TOTP-based accounts, it produces the current time-limited authenticator code from an existing shared setup key. It does not create SMS codes, recovery codes, push approvals, or a new account secret.
The generator supports SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, and a period from 10 to 120 seconds. otpauth links can set these options automatically.
No. It converts an existing authenticator setup key into the current TOTP code. The 2FA secret is created by the website or app where you enable two-factor authentication.
Yes, store important setup keys carefully in a trusted authenticator app or password manager. Without the setup key or recovery codes, this tool cannot recreate access to an account.
The most common causes are a mistyped Base32 secret, wrong device time, or mismatched TOTP options. Confirm the algorithm, digit count, and period shown by the service that provided the 2FA setup key.
Yes, when the account uses a standard TOTP setup key or otpauth://totp/ link. Paste the Base32 secret or otpauth URI and match the algorithm, digit count, and period shown by the account setup page.
Yes in browsers that support local QR image detection. Choose a QR code screenshot or image, and the page reads the otpauth URI in the browser without uploading the image to a server.
Confirm that you control the setup key, keep recovery codes in a safe place, and avoid sharing real secrets in URLs. For long-term storage, use a trusted authenticator app or password manager.
No. It generates the current code from an existing setup key. The setup key must come from the website or app where you enabled two-factor authentication.
No. It is for authenticator app style TOTP codes. SMS, email, recovery codes, push approvals, passkeys, and hardware security keys use different methods.
For TOTP, people often use both terms for the short number that changes on a timer. More precisely, the software token holds the setup secret and generates the current code you enter during sign-in.
The fragment format is recommended because content after # is not sent with HTTP requests. Path and query formats are also supported, and those pages are marked noindex to avoid indexing secret-bearing URLs.
https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/#YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/?secret=YOUR_BASE32_SECRETDo not share real 2FA secrets with other people. For temporary shortcuts, prefer the #secret= fragment URL.
Last updated: 2026-09-12. TOTP generation follows RFC 6238 and compatible otpauth setup links.