Paste an MFA TOTP setup key to generate a local token code
This MFA token generator is for multi-factor authentication setups that use standard time-based one-time passwords. Paste the Base32 setup secret, otpauth URI, or supported QR image data to calculate the current token code locally.
The generator does not submit a typed or pasted setup key to a backend API to calculate the code, and it has no account database for storing secrets. The current key stays in the page state while you use it. For important long-term secrets, use a trusted authenticator app or password manager.
This tool generates the current time-based authenticator code from setup data you already have. It does not create a new account secret, recover a missing key, produce SMS or email codes, or bypass an account's official security flow.
Begin in the account provider's official security settings. For ChatGPT or another service, use this independent tool only when that provider displays a standard Base32 TOTP key or otpauth URI; the tool cannot access or enroll the account for you.
A 2FA token generator usually means the same TOTP workflow: the account provider creates a shared setup key, and the generator calculates the current short-lived code. This tool needs that Base32 key or an otpauth URI; it cannot derive a valid token from an account name alone.
This generator is built for standard TOTP setup keys used by Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, 2FAS, FreeOTP, and many other 2FA or MFA flows. Use it when a service shows a manual setup key, Base32 secret, or otpauth URI.
Most accounts use SHA-1, 6 digits, and a 30-second period. If a code is rejected, check the copied secret, your device time, and whether the service requires 8 digits, SHA-256, SHA-512, or a different period.
For a temporary link, the fragment format keeps the secret after # in the browser. Clean tool and guide pages are indexable, while server-visible path or query URLs containing secrets are returned with noindex and no-store headers.
If a service only shows an authenticator QR code, save or screenshot the QR image and use the QR image button. Supported browsers read the otpauth URI locally with the built-in BarcodeDetector API; unsupported browsers can still use the manual setup key or pasted otpauth text.
Many MFA systems use TOTP token codes, while others use push approval, WebAuthn, passkeys, SMS, or email. This page is only for TOTP token codes that come from a shared setup secret.
Add another generator for each MFA token you need to compare or use temporarily. Each generator keeps its own secret, label, countdown, and TOTP settings.
The default MFA token profile is SHA-1, 6 digits, and 30 seconds. Advanced settings also support SHA-256, SHA-512, 8 digits, and custom periods when a service specifies them.
Use this matrix to check what this local TOTP/2FA generator can accept and which setting to verify before copying a code.
| Need | Input or setting | What to check | Result |
|---|---|---|---|
| Manual 2FA setup key | Base32 secret with optional spaces, hyphens, or padding | Copy the full key from the account security page | The visible field keeps your pasted format while calculation normalizes it locally |
| otpauth setup link | otpauth://totp/ URI from an authenticator QR code or setup screen | The URI includes a secret parameter and optional issuer, digits, period, and algorithm | The tool reads supported TOTP parameters and updates the generator options |
| Authenticator QR image | QR screenshot or saved image | Browser supports local BarcodeDetector API | The QR is read in the browser; no upload is needed |
| Multiple accounts | One independent generator per secret | Use Add generator only when you need another account or MFA token | Each generator has its own name, secret, countdown, and copy button |
| Advanced TOTP settings | SHA-1, SHA-256, SHA-512; 6 or 8 digits; 10-120 second period | Match the service setup screen if it is not the common 6-digit 30-second default | Codes align with RFC 6238-compatible authenticator apps |
| URL secret shortcut | #secret= fragment, path secret, or ?secret= query | Prefer fragment links because the secret after # is not sent in HTTP requests | Path and query secret pages are served noindex/no-store |
Base32 setup keys, formatted keys with spaces, hyphens, or padding, full otpauth://totp/ setup links, and authenticator QR code images when the browser supports local barcode detection.
Google Authenticator compatible TOTP, Microsoft Authenticator compatible TOTP, 1Password, Bitwarden, 2FAS, FreeOTP, Authy-style setup keys, and similar MFA apps.
SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, 10 to 120 second periods, and the common 30-second authenticator countdown.
Use #secret= for the safest shortcut because URL fragments are not sent in HTTP requests. Path and ?secret= query shortcuts still work and are marked noindex.
The tool generates standard TOTP authenticator codes from a setup secret. It does not create new account secrets, store recovery codes, approve push prompts, or replace account recovery settings.
Use this page for MFA token codes generated from a TOTP secret. It is not a replacement for a physical security key or administrator-issued hardware token.
Paste the Base32 secret or otpauth URI assigned to the software token profile.
Set the algorithm, number of digits, and token period to the values required by the service or identity provider.
Copy the current MFA token code while the countdown is active. Keep the secret separate from passwords and recovery material.
TOTP means time-based one-time password. An authenticator app and a service share a Base32 secret, then use the current time to create a short code that usually changes every 30 seconds.
The TOTP calculation runs in your browser with Web Crypto. No account is required, and the secret is not submitted to a backend API for code generation. For URL shortcuts, prefer the #secret= fragment format.
The generator does not upload the setup key to a backend API for TOTP calculation or save it in an account database. Typed keys remain in the current page state; avoid path or query secret URLs and use a trusted authenticator app for long-term storage.
The page starts with one generator. Click Add generator for each extra 2FA or MFA secret, optionally rename it, paste a Base32 secret or otpauth URI, then copy the code you need.
Yes. The recommended format is https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECRET. Path shortcuts and ?secret= query URLs also work.
Only when your ChatGPT account's own security settings provide a standard TOTP setup key or otpauth URI. Enable or manage MFA in the official account settings first. This independent tool cannot access the account, recover a missing secret, or approve a push request.
For TOTP-based accounts, it produces the current time-limited authenticator code from an existing shared setup key. It does not create SMS codes, recovery codes, push approvals, or a new account secret.
The generator supports SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, and a period from 10 to 120 seconds. otpauth links can set these options automatically.
No. It converts an existing authenticator setup key into the current TOTP code. The 2FA secret is created by the website or app where you enable two-factor authentication.
Yes, store important setup keys carefully in a trusted authenticator app or password manager. Without the setup key or recovery codes, this tool cannot recreate access to an account.
The most common causes are a mistyped Base32 secret, wrong device time, or mismatched TOTP options. Confirm the algorithm, digit count, and period shown by the service that provided the 2FA setup key.
Yes, when the account uses a standard TOTP setup key or otpauth://totp/ link. Paste the Base32 secret or otpauth URI and match the algorithm, digit count, and period shown by the account setup page.
Yes in browsers that support local QR image detection. Choose a QR code screenshot or image, and the page reads the otpauth URI in the browser without uploading the image to a server.
Confirm that you control the setup key, keep recovery codes in a safe place, and avoid sharing real secrets in URLs. For long-term storage, use a trusted authenticator app or password manager.
Often yes. Many authenticator-style MFA tokens are TOTP codes generated from a shared secret and the current time. Some MFA methods use different technology.
It can generate standard TOTP token codes when you have the Base32 setup secret or otpauth URI. It cannot approve push prompts or replace an enterprise identity provider.
Yes. Add another generator for each setup key. The page starts with one generator so the interface stays simple until you need more.
The fragment format is recommended because content after # is not sent with HTTP requests. Path and query formats are also supported, and those pages are marked noindex to avoid indexing secret-bearing URLs.
https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/#YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/?secret=YOUR_BASE32_SECRETDo not share real 2FA secrets with other people. For temporary shortcuts, prefer the #secret= fragment URL.
Last updated: 2026-09-12. TOTP generation follows RFC 6238 and compatible otpauth setup links.