Paste a secret and adjust TOTP digits, period, or algorithm
A portable otpauth TOTP link needs a Base32 secret and can include issuer, algorithm, digits, and period. The image parameter is different: it is an app-specific extension documented by FreeOTP, not part of the archived Google Authenticator Key URI parameter list, so other authenticator apps may ignore it.
The generator does not submit a typed or pasted setup key to a backend API to calculate the code, and it has no account database for storing secrets. The current key stays in the page state while you use it. For important long-term secrets, use a trusted authenticator app or password manager.
This tool generates the current time-based authenticator code from setup data you already have. It does not create a new account secret, recover a missing key, produce SMS or email codes, or bypass an account's official security flow.
Begin in the account provider's official security settings. For ChatGPT or another service, use this independent tool only when that provider displays a standard Base32 TOTP key or otpauth URI; the tool cannot access or enroll the account for you.
A 2FA token generator usually means the same TOTP workflow: the account provider creates a shared setup key, and the generator calculates the current short-lived code. This tool needs that Base32 key or an otpauth URI; it cannot derive a valid token from an account name alone.
This generator is built for standard TOTP setup keys used by Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, 2FAS, FreeOTP, and many other 2FA or MFA flows. Use it when a service shows a manual setup key, Base32 secret, or otpauth URI.
Most accounts use SHA-1, 6 digits, and a 30-second period. If a code is rejected, check the copied secret, your device time, and whether the service requires 8 digits, SHA-256, SHA-512, or a different period.
For a temporary link, the fragment format keeps the secret after # in the browser. Clean tool and guide pages are indexable, while server-visible path or query URLs containing secrets are returned with noindex and no-store headers.
If a service only shows an authenticator QR code, save or screenshot the QR image and use the QR image button. Supported browsers read the otpauth URI locally with the built-in BarcodeDetector API; unsupported browsers can still use the manual setup key or pasted otpauth text.
secret, algorithm, digits, and period affect TOTP generation. issuer and the label identify the account but do not change the code. Common defaults are SHA-1, 6 digits, and 30 seconds when the provisioning data does not specify alternatives.
FreeOTP documents image as an optional URL for a token icon. It does not affect the secret or one-time password. This tool ignores image and other unknown parameters and never fetches a remote image URL while parsing an otpauth link.
Do not assume that an app-specific image extension is portable. The archived Google Key URI format does not define image, and Microsoft Authenticator does not provide a general compatibility guarantee for third-party image values. Use issuer and account labels for portable identification, then test the exact app version before deployment.
Use this matrix to check what this local TOTP/2FA generator can accept and which setting to verify before copying a code.
| Need | Input or setting | What to check | Result |
|---|---|---|---|
| Manual 2FA setup key | Base32 secret with optional spaces, hyphens, or padding | Copy the full key from the account security page | The visible field keeps your pasted format while calculation normalizes it locally |
| otpauth setup link | otpauth://totp/ URI from an authenticator QR code or setup screen | The URI includes a secret parameter and optional issuer, digits, period, and algorithm | The tool reads supported TOTP parameters and updates the generator options |
| Authenticator QR image | QR screenshot or saved image | Browser supports local BarcodeDetector API | The QR is read in the browser; no upload is needed |
| Multiple accounts | One independent generator per secret | Use Add generator only when you need another account or MFA token | Each generator has its own name, secret, countdown, and copy button |
| Advanced TOTP settings | SHA-1, SHA-256, SHA-512; 6 or 8 digits; 10-120 second period | Match the service setup screen if it is not the common 6-digit 30-second default | Codes align with RFC 6238-compatible authenticator apps |
| URL secret shortcut | #secret= fragment, path secret, or ?secret= query | Prefer fragment links because the secret after # is not sent in HTTP requests | Path and query secret pages are served noindex/no-store |
Base32 setup keys, formatted keys with spaces, hyphens, or padding, full otpauth://totp/ setup links, and authenticator QR code images when the browser supports local barcode detection.
Google Authenticator compatible TOTP, Microsoft Authenticator compatible TOTP, 1Password, Bitwarden, 2FAS, FreeOTP, Authy-style setup keys, and similar MFA apps.
SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, 10 to 120 second periods, and the common 30-second authenticator countdown.
Use #secret= for the safest shortcut because URL fragments are not sent in HTTP requests. Path and ?secret= query shortcuts still work and are marked noindex.
The tool generates standard TOTP authenticator codes from a setup secret. It does not create new account secrets, store recovery codes, approve push prompts, or replace account recovery settings.
Use the Base32 secret or otpauth URI from the account setup screen. Do not use a recovery code, SMS code, or account password.
Choose the algorithm, digit count, and period shown by the service. Common defaults are SHA-1, 6 digits, and 30 seconds.
Use the generated code in the same time window as the service. If it fails, check device time and every copied character in the secret.
Save the parameter set that the service explicitly uses. Guessing different algorithms or periods can make a valid secret produce invalid codes.
TOTP means time-based one-time password. An authenticator app and a service share a Base32 secret, then use the current time to create a short code that usually changes every 30 seconds.
The TOTP calculation runs in your browser with Web Crypto. No account is required, and the secret is not submitted to a backend API for code generation. For URL shortcuts, prefer the #secret= fragment format.
The generator does not upload the setup key to a backend API for TOTP calculation or save it in an account database. Typed keys remain in the current page state; avoid path or query secret URLs and use a trusted authenticator app for long-term storage.
The page starts with one generator. Click Add generator for each extra 2FA or MFA secret, optionally rename it, paste a Base32 secret or otpauth URI, then copy the code you need.
Yes. The recommended format is https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECRET. Path shortcuts and ?secret= query URLs also work.
Only when your ChatGPT account's own security settings provide a standard TOTP setup key or otpauth URI. Enable or manage MFA in the official account settings first. This independent tool cannot access the account, recover a missing secret, or approve a push request.
For TOTP-based accounts, it produces the current time-limited authenticator code from an existing shared setup key. It does not create SMS codes, recovery codes, push approvals, or a new account secret.
The generator supports SHA-1, SHA-256, and SHA-512 algorithms, 6 or 8 digit codes, and a period from 10 to 120 seconds. otpauth links can set these options automatically.
No. It converts an existing authenticator setup key into the current TOTP code. The 2FA secret is created by the website or app where you enable two-factor authentication.
Yes, store important setup keys carefully in a trusted authenticator app or password manager. Without the setup key or recovery codes, this tool cannot recreate access to an account.
The most common causes are a mistyped Base32 secret, wrong device time, or mismatched TOTP options. Confirm the algorithm, digit count, and period shown by the service that provided the 2FA setup key.
Yes, when the account uses a standard TOTP setup key or otpauth://totp/ link. Paste the Base32 secret or otpauth URI and match the algorithm, digit count, and period shown by the account setup page.
Yes in browsers that support local QR image detection. Choose a QR code screenshot or image, and the page reads the otpauth URI in the browser without uploading the image to a server.
Confirm that you control the setup key, keep recovery codes in a safe place, and avoid sharing real secrets in URLs. For long-term storage, use a trusted authenticator app or password manager.
No. It is presentation metadata in apps that implement the extension. The TOTP result depends on the secret, algorithm, digits, period, and current time.
The generic Google Key URI format does not define image, and there is no portable guarantee that Microsoft Authenticator will use a third-party image URL. Treat image as app-specific and optional.
Use the algorithm provided by the service. If nothing is specified, SHA-1 with 6 digits and a 30-second period is the common TOTP default.
The fragment format is recommended because content after # is not sent with HTTP requests. Path and query formats are also supported, and those pages are marked noindex to avoid indexing secret-bearing URLs.
https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/#YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/YOUR_BASE32_SECREThttps://2fa.chatgpt.org.uk/?secret=YOUR_BASE32_SECRETDo not share real 2FA secrets with other people. For temporary shortcuts, prefer the #secret= fragment URL.
Last updated: 2026-09-12. TOTP generation follows RFC 6238 and compatible otpauth setup links.