UsefulTab

How to set up TOTP two-factor codes

Those rotating six-digit codes from an authenticator app are TOTP. This guide explains how they work, what the setup secret is, and how to generate a code from a secret when you need to — without anything touching a server.

The fastest way

Paste a TOTP secret into the TOTP Generator and it shows the current six-digit code and its countdown. Read on for what's actually happening.

How TOTP works

At setup, the service and your authenticator share a secret key (shown as a QR code and a base32 string). From then on, both sides combine that secret with the current time to derive the same code, rotating every 30 seconds. Nothing is sent over the network — which is exactly why it keeps working offline.

Guard the secret, and back it up

The secret is the second factor. Anyone who has it can generate your codes, so treat it like a password — and keep a safe backup of it, or of the recovery codes the service gives you, so a lost phone doesn't lock you out.

When codes don't work

If codes are rejected, it's almost always clock skew. TOTP relies on accurate time; if your device clock drifts more than ~30 seconds, the codes won't line up. Turn on automatic network time to fix it.

Strong passwords still matter

Two-factor protects an account, but the password is still the first line. Generate a strong, unique one with the Password Generator.

A note on privacy

The TOTP Generator derives codes in your browser, so your secret is never uploaded to a server.

Open the TOTP Generator →

Common questions

What is TOTP?

TOTP (Time-based One-Time Password) is the standard behind authenticator-app codes. The service and your app share a secret key once at setup; each then derives the same six-digit code from that secret and the current time, so the code changes every 30 seconds without any network traffic.

What is the secret key I see at setup?

It's the shared seed — usually shown as a QR code and a base32 string. Your authenticator stores it and uses it with the clock to generate codes. Anyone with that secret can generate your codes, so treat it like a password and store a backup somewhere safe.

Why do codes sometimes fail?

Almost always clock skew — TOTP depends on accurate time. If your device clock is off by more than about 30 seconds, codes won't match. Enabling automatic network time fixes it.

Is my secret uploaded when I generate a code?

No. The code is derived from your secret and the current time entirely in your browser, so the secret never leaves your device.