Paste a 2FA secret key to generate the current code
Use this page when you already have a 2FA secret key and need the current authenticator code. The generator accepts Base32 setup keys and otpauth links, then calculates the time-based TOTP code in your browser.
The generator does not submit a typed or pasted setup key to a backend API to calculate the code, and it has no account database for storing secrets. The current key stays in the page state while you use it. For important long-term secrets, use a trusted authenticator app or password manager.
This tool generates the current time-based authenticator code from setup data you already have. It does not create a new account secret, recover a missing key, produce SMS or email codes, or bypass an account's official security flow.
Begin in the account provider's official security settings. For ChatGPT or another service, use this independent tool only when that provider displays a standard Base32 TOTP key or otpauth URI; the tool cannot access or enroll the account for you.
A 2FA token generator usually means the same TOTP workflow: the account provider creates a shared setup key, and the generator calculates the current short-lived code. This tool needs that Base32 key or an otpauth URI; it cannot derive a valid token from an account name alone.
This generator is built for standard TOTP setup keys used by Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, 2FAS, FreeOTP, and many other 2FA or MFA flows. Use it when a service shows a manual setup key, Base32 secret, or otpauth URI.
Most accounts use SHA-1, 6 digits, and a 30-second period. If a code is rejected, check the copied secret, your device time, and whether the service requires 8 digits, SHA-256, SHA-512, or a different period.
For a temporary link, the fragment format keeps the secret after # in the browser. Clean tool and guide pages are indexable, while server-visible path or query URLs containing secrets are returned with noindex and no-store headers.
If a service only shows an authenticator QR code, save or screenshot the QR image and use the QR image button. Supported browsers read the otpauth URI locally with the built-in BarcodeDetector API; unsupported browsers can still use the manual setup key or pasted otpauth text.
The 2FA secret comes from the security settings page of the website or app you are protecting. This tool does not create a new secret, recover a lost secret, or bypass account recovery.
Paste a Base32 secret, a full otpauth:// URI, or a formatted key with spaces, hyphens, or padding. URL shortcuts also work, but the #secret= fragment format is preferred for temporary links.
Use this matrix to check what this local TOTP/2FA generator can accept and which setting to verify before copying a code.
| Need | Input or setting | What to check | Result |
|---|---|---|---|
| Manual 2FA setup key | Base32 secret with optional spaces, hyphens, or padding | Copy the full key from the account security page | The visible field keeps your pasted format while calculation normalizes it locally |
| otpauth setup link | otpauth://totp/ URI from an authenticator QR code or setup screen | The URI includes a secret parameter and optional issuer, digits, period, and algorithm | The tool reads supported TOTP parameters and updates the generator options |
| Authenticator QR image | QR screenshot or saved image | Browser supports local BarcodeDetector API | The QR is read in the browser; no upload is needed |
| Multiple accounts | One independent generator per secret | Use Add generator only when you need another account or MFA token | Each generator has its own name, secret, countdown, and copy button |
| Advanced TOTP settings | SHA-1, SHA-256, SHA-512; 6 or 8 digits; 10-120 second period | Match the service setup screen if it is not the common 6-digit 30-second default | Codes align with RFC 6238-compatible authenticator apps |
| URL secret shortcut | #secret= fragment, path secret, or ?secret= query | Prefer fragment links because the secret after # is not sent in HTTP requests | Path and query secret pages are served noindex/no-store |
Base32 setup keys, formatted keys with spaces, hyphens, or padding, full otpauth://totp/ setup links, and authenticator QR code images when the browser supports local barcode detection.
Google Authenticator compatible TOTP, Microsoft Authenticator compatible TOTP, 1Password, Bitwarden, 2FAS, FreeOTP, Authy-style setup keys, and similar MFA apps.
SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, 10 to 120 second periods, and the common 30-second authenticator countdown.
Use #secret= for the safest shortcut because URL fragments are not sent in HTTP requests. Path and ?secret= query shortcuts still work and are marked noindex.
The tool generates standard TOTP authenticator codes from a setup secret. It does not create new account secrets, store recovery codes, approve push prompts, or replace account recovery settings.
Use this page only when you already have the shared 2FA secret or setup key. It cannot recover a missing secret from an account or old code.
Enter the Base32 secret or otpauth URI from the setup screen. Do not paste passwords, recovery codes, SMS messages, or email OTPs.
Use the same algorithm, digit count, and period as the account provider. These settings must match for the generated code to verify.
Submit the displayed code before the countdown ends. Treat the secret as sensitive because anyone with it can generate future 2FA codes.
TOTP means time-based one-time password. An authenticator app and a service share a Base32 secret, then use the current time to create a short code that usually changes every 30 seconds.
The TOTP calculation runs in your browser with Web Crypto. No account is required, and the secret is not submitted to a backend API for code generation. For URL shortcuts, prefer the #secret= fragment format.
The generator does not upload the setup key to a backend API for TOTP calculation or save it in an account database. Typed keys remain in the current page state; avoid path or query secret URLs and use a trusted authenticator app for long-term storage.
The page starts with one generator. Click Add generator for each extra 2FA or MFA secret, optionally rename it, paste a Base32 secret or otpauth URI, then copy the code you need.
Yes. The recommended format is https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECRET. Path shortcuts and ?secret= query URLs also work.
Only when your ChatGPT account's own security settings provide a standard TOTP setup key or otpauth URI. Enable or manage MFA in the official account settings first. This independent tool cannot access the account, recover a missing secret, or approve a push request.
For TOTP-based accounts, it produces the current time-limited authenticator code from an existing shared setup key. It does not create SMS codes, recovery codes, push approvals, or a new account secret.
The generator supports SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, and a period from 10 to 120 seconds. otpauth links can set these options automatically.
No. It converts an existing authenticator setup key into the current TOTP code. The 2FA secret is created by the website or app where you enable two-factor authentication.
Yes, store important setup keys carefully in a trusted authenticator app or password manager. Without the setup key or recovery codes, this tool cannot recreate access to an account.
The most common causes are a mistyped Base32 secret, wrong device time, or mismatched TOTP options. Confirm the algorithm, digit count, and period shown by the service that provided the 2FA setup key.
Yes, when the account uses a standard TOTP setup key or otpauth://totp/ link. Paste the Base32 secret or otpauth URI and match the algorithm, digit count, and period shown by the account setup page.
Yes in browsers that support local QR image detection. Choose a QR code screenshot or image, and the page reads the otpauth URI in the browser without uploading the image to a server.
Confirm that you control the setup key, keep recovery codes in a safe place, and avoid sharing real secrets in URLs. For long-term storage, use a trusted authenticator app or password manager.
Yes. If the secret key is a valid TOTP Base32 setup key, paste it into the generator and the current 2FA authenticator code will be calculated locally.
No. TOTP codes require the original shared secret. If the secret is lost, use the account's recovery codes or contact the service that issued the 2FA setup key.
The fragment format is recommended because content after # is not sent with HTTP requests. Path and query formats are also supported, and those pages are marked noindex to avoid indexing secret-bearing URLs.
https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/#YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/?secret=YOUR_BASE32_SECRETDo not share real 2FA secrets with other people. For temporary shortcuts, prefer the #secret= fragment URL.
Last updated: 2026-09-12. TOTP generation follows RFC 6238 and compatible otpauth setup links.