Using TOTP
2FA code generator: use it safely
Learn how a 2FA code generator works, which TOTP settings must match your account, and how to use a short-lived code without sharing its secret.
A code generator derives, rather than receives, the code
A 2FA code generator uses the setup secret and the current time to calculate a temporary code. The account provider performs the same calculation during sign-in, so neither side needs to send a fresh code to the other before you log in.
The visible code is not the setup secret. It normally expires after 30 seconds and cannot reveal the secret by itself. The setup secret, however, can generate every future code, which is why it should never be pasted into a support chat or shared document.
Match the account's settings exactly
Most accounts use TOTP with SHA-1, six digits, and a 30-second period. Those are common defaults, not a guarantee. A code generator must match the secret, algorithm, digit count, and period supplied by the service or the result will look valid but be rejected.
A setup QR code or otpauth URI often carries these details together. If you enter a secret manually, compare the service's displayed settings before relying on the generated result.
- Wait for a new code if the current one is about to expire.
- Confirm automatic time is enabled on the device.
- Check that you selected the right account when similar labels exist.
Choose the right tool for the job
A browser-based generator can be useful for a focused, temporary calculation when it processes the secret locally. For everyday storage of many accounts, a reputable authenticator or password manager with a deliberate backup plan is usually a better long-term choice.
Whatever tool you choose, verify the domain before entering a secret, keep software up to date, and use a phishing-resistant sign-in method when a service supports one.