Two Factor QR Code Generator

Skip the 32-character typing session: this Two Factor QR Code Generator turns your secret key, account label and issuer into a single 2FA setup image, so your authenticator picks the account up with one scan and starts producing codes straight away.

Two Factor QR Code Generator: What It Builds and Why

A 2FA QR code generator does one narrow job: it wraps the details an authenticator needs into a URI and draws that URI as a picture. Nothing about the picture is magical. It is the same text you could type the secret from, only encoded so a phone camera can read it in a fraction of a second. Services such as Google, GitHub or Discord show you exactly this kind of picture when you switch on two factor authentication. You can build an otpauth uri in seconds with a free tool that runs entirely in your browser.

Use it when a website hands you only a text secret key, when you want to move an account to a second device, or when you build a test account and need a repeatable setup. It is a free, online 2FA tool, and you can also use it to check that a secret you generated yourself is valid before real users depend on it.

What a 2FA Setup Image Actually Contains

The picture encodes an otpauth URI. In the URI format, five parts matter: the type (totp or hotp), a label made of issuer and account name, the Base32 secret, the issuer repeated as a parameter, and the optional algorithm, digits and period values. Anyone who photographs the image owns the secret, so treat it like a password.

otpauth://totp/PasswordHive:[email protected]?secret=KVKFKRCPNZQUYMLXOVYDSQKJKZDTSRLD&issuer=PasswordHive&algorithm=SHA1&digits=6&period=30

That 144-character string is the worked example used throughout this guide. The secret decodes to 20 bytes, or 160 bits, the length the standard recommends for the SHA-1 hash. Treat it as an authenticator secret for demonstration only. Never reuse a published demonstration key such as JBSWY3DPEHPK3PXP, which appears in countless tutorials, on a real login.

Why the TOTP Standard Needs a Shared Secret

TOTP works because two sides hold the same value and the same clock. The service keeps your secret on its server, your phone keeps it in the app, and neither sends it again. Each side computes the answer separately and compares. That is why a good TOTP generator never has to contact the service: the only inputs are the secret and the current time.

How to Use the 2FA Code Generator Step by Step

The whole flow takes under a minute once you have a secret, and you can generate and check codes online without installing anything. You enter the values, the tool draws the image, and your authenticator app reads it. This order avoids the usual mistakes. The free totp secret generator gives you a copy-ready result instantly, with no account required.

1. Copy the Base32 secret key from the service's 2FA setup page.
2. Type an issuer and an account label so you can tell entries apart later.
3. Leave the algorithm on SHA1, digits on 6 and period on 30 unless the service says otherwise.
4. Scan the image, then compare the 6-digit code in your app with the 2FA code the page shows.

Enter the Secret Key, Issuer and Account Label

Paste the secret exactly as the service displayed it. Spaces and lowercase letters are harmless because Base32 only uses A to Z and the digits 2 to 7, but a stray 0, 1, 8 or 9 means a typo. The issuer is the brand name shown above the code in your app; the label is usually your email address. In the example, the issuer is PasswordHive and the label is [email protected]. If your secret arrives as a file instead of text, you can upload QR image files to read the secret back out, or use drag & drop where the tool supports it, and a saved offline version of the page keeps everything off the network.

Scan a QR Code With Your Authenticator App

Open the app, choose to add an account, and point the camera at the screen. Most apps include a built-in QR code scanner; if yours reads pictures instead, take a screenshot and import it. Apps without a camera, including many desktop tools, accept manual entry of the same secret. After the scan, the app lists the account with the issuer on top and a code underneath that refreshes on a countdown.

Enable 2FA on a Real Account

To enable 2FA on a live account, open its security settings, pick an authenticator app as the method, and feed the secret the service gives you into the generator. Then type the first code the service asks for before closing the page. Many sites will not finish activating until you do, and that confirmation proves the secret, the clock and the app all agree. Before leaving, save the recovery codes.

TOTP Formula: From Secret Key to Six-Digit Code

Every TOTP code generator follows RFC 6238, which builds on the counter-based method in RFC 4226. The steps are fixed, so the same secret and the same second give the same code on any device. That is also why a Google Authenticator entry and a browser tool can match digit for digit.

The Time Counter and the HMAC Hash

The first step turns the clock into a counter by dividing the Unix timestamp by the period and rounding down:

$$C = \left\lfloor \frac{T}{30} \right\rfloor$$

At 00:00:00 UTC on 1 January 2026, \(T = 1{,}767{,}225{,}600\), so \(C = 58{,}907{,}520\). The counter is then signed with the secret using HMAC-SHA1, which produces 20 bytes. For the example secret, the hash begins bad8d654 and ends fc7415.

Dynamic Truncation to a 6-Digit Verification Code

The last hex digit of the hash, 5, is the offset. Four bytes from that offset form a 31-bit integer, 376,529,268 here. The final 6-digit value is the remainder after dividing by one million:

$$\text{code} = 376{,}529{,}268 \bmod 10^{6} = 529{,}268$$

So the verification code for that second is 529268. This temporary verification code is a rotating value: it will expire 30 seconds later, and the page will refresh it for the next window.

Notice that 00:00:29 still gives 529268. Only the counter matters, not the exact second inside the window.

2FA Advanced Options: Algorithm, Digits, Period and Counter

Most services accept the defaults: SHA-1, six digits, thirty seconds. The advanced options exist for the few that do not, and changing them without a reason makes your codes disagree with the server.

Algorithm

The hash behind the code: SHA1, SHA256 or SHA512.

Digits

Code length, normally 6, sometimes 8.

Period

How many seconds each code lasts, normally 30.

Counter

The starting value for event-based codes; ignored for time-based ones.

SHA1, SHA256 and SHA512 Compared

For the same secret and second, switching to SHA-256 changes the code from 529268 to 588849. Both are correct; they are different functions, and the server and your app must agree on one. SHA-1 stays the default because every app understands it, and for a short-lived code its known weaknesses matter far less than they would for a signature.

Which Authenticator Apps Honor the Options

Support is uneven. Google Authenticator ignores the algorithm, digits and period values and always computes a 6-digit SHA-1 code, so a SHA-256 setup silently gives wrong codes there. Yubico Authenticator, FreeOTP and Authy read more of them, and Microsoft Authenticator expects the defaults. Authy and the others are all compatible with the default setup, so when in doubt keep the defaults.

Two-Factor Authentication Methods Compared

Two-factor authentication asks for something you know, your password, plus something you have, such as the device holding a secret. That second factor stops a thief who has only your password, and it adds an extra layer of security that blocks unauthorized access. Also called two-step verification, it comes in several forms, and TOTP is the one this tool serves.

• SMS codes: easy to set up, but an SMS message can be redirected by SIM-swap attacks and phishing.
• Authenticator app codes: no signal needed, nothing to intercept in transit.
• Hardware keys: the strongest option against phishing, at the cost of buying a key.
• Biometrics: convenient, but usually unlock a device rather than the account itself.

TOTP vs HOTP

TOTP derives the code from the clock, while HOTP derives it from a counter that advances each time you press a button. A time-based one-time password expires on its own, which is why it dominates consumer logins. The HMAC-based counter method suits devices without a clock. Both are a one-time password, shortened to OTP in many tool names, which is why an OTP QR generator usually lets you pick the type first. A combined 2FA TOTP generator or a plain 2FA generator typically defaults to the time-based type.

Services That Accept a 2FA Setup Image

Any website that follows the standard works, including Microsoft's authentication settings and every 2FA login below, because the image carries no vendor-specific data. A 2FA auth step is the same everywhere, and Google's authentication prompt works no differently from a small website's; only the menu path differs.

• Google and Microsoft accounts, where 2FA lives under security settings and any standard app can supply the verification codes.
• Facebook, Dropbox and Amazon, which all offer an authenticator app method; Facebook lets you register more than one device.
• Cloudflare and Coinbase, where 2FA protects dashboards and funds.
• Steam and Fortnite, where 2FA is often required for trading or rewards and Fortnite players commonly pick an app.

Moving a GitHub Login to a New Phone with a 2FA QR Code Generator

Ilse Brandvold is a freelance developer whose old phone has a cracked camera, and the replacement arrives on a Saturday morning. Before wiping anything, Ilse opens the GitHub security page and finds the original setup key in a password manager note: H4TWQ2MFNRXJ6B7PCS3KZYEAUV5DLOIG, 32 characters of Base32, which fits the 160-bit length the standard recommends.

Ilse pastes the key into the generator, types GitHub as the issuer and [email protected] as the label, and leaves SHA1, 6 digits and 30 seconds untouched, since GitHub documents exactly those defaults. The page draws the image and, underneath, shows the live code. The new phone scans it in one pass and lists the entry within a second.

The check comes next. At 09:26:53 UTC the page shows 890023, and the app on the new phone shows 890023 too. Only 7 seconds remain in that window, because 1,773,480,413 mod 30 is 23, so Ilse does not rush: the next window, counter 59,116,014, will read 219365, and a match on that code would be the second confirmation. It matches.

• Counter in play: 59,116,013 for the first code.
• Offset taken from the hash: 9.
• Result: a 6-digit code both devices agree on.

That agreement is the whole decision. Two matching codes in two consecutive windows rule out a typo in the secret and a clock problem, so Ilse removes the cracked-camera phone from GitHub's list of authenticator devices instead of keeping it as a fallback. The only follow-up is a rerun of the generator with one input changed, the issuer label, so the entry reads "GitHub (work)" rather than sitting next to a personal account of the same name.

Using a TOTP Generator for Testing and Automation

Developers use the same math to remove friction from test automation. A QA script cannot hold a phone, so tools such as Selenium and Playwright call an API or a library that can generate the current code from a stored secret. A tool built on a REST API returns the code for a secret you send it.

For testing, create a dedicated account with its own secret, keep the secret in the CI vault, and never reuse a production secret. Doing so keeps automation reliable on any login form without weakening the real account, and it lets testing run in the cloud without a device. You can also download the generated image once and keep it with your test fixtures. The open-source kjua library draws such images in the browser.

Keeping Your 2FA Secrets Private

A secret key is the one thing in this system an attacker must never see. A well-built 2FA tool computes everything locally in your browser using the Web Crypto API, so secrets are never stored on a server. That design protects your privacy and keeps the tool safe and secure to use. If a tool uploads your secret to build the image, treat that secret as already exposed and generate a fresh one.

Short-lived codes also defeat replay attacks: a code captured by a hacker is useless once its window has passed. Phishing sites can still relay a code in real time, which is why mobile push prompts and hardware keys are stronger.

• Clear the page and any recent keys list on shared computers.
• Store exported backup files in an encrypted password manager, not an open folder.
• Never paste a live secret into a chat, ticket or screenshot.

2FA Security Best Practices

These best practices tie back to what the generator produces and keep two-factor authentication resilient: keep the secret and the setup image in encrypted storage, add 2FA wherever it is offered, save your 2FA recovery codes offline, and rerun the generator for each new device instead of copying screenshots around, because stale copies of a secret quietly weaken security.

Backup and Recovery Before You Need It

The same codes that protect your login can lock you out. If the only copy of a secret lives on one phone and that phone is gone, the account needs a full recovery process. Keep the original secret, or the setup image, in encrypted storage so you can add a second device at any time. Features like saved accounts and import backup are worth using only when the file stays encrypted.

2FA Troubleshooting: When a Code Is Rejected

Most failures come down to three things: a wrong secret, a wrong clock or mismatched options. Work through them in that order, and keep your 2FA app open while you do.

Invalid Code or Incorrect Verification Code

If the service says the 2FA code is invalid, check the clock first. TOTP depends on the Unix timestamp, so a phone that is a minute off can fail every attempt. Turn on automatic time. Then confirm the algorithm, digits and period match what the service expects, and that you did not mistype the secret.

QR Code Will Not Scan

If the QR code will not scan, enlarge it, raise your screen brightness, and avoid dark-mode filters. A cropped screenshot is the other common cause. When nothing works, use manual entry with the text secret.

Lost Phone or Locked Out of Your Account

With a lost phone you are locked out until you use a recovery code or the service's identity check. This is what backups are for.

2FA reset checklist

Find your recovery codes, sign in once, remove the old authenticator entry, then run the setup again with a new secret.

2FA Glossary for Authenticator Setup

Secret

A shared Base32 string that both sides keep private. A 2FA secret is as sensitive as a password.

TOTP

A time-based one-time password defined in RFC 6238, the verification method behind most 2FA apps.

Window

The 30-second span in which one code is valid.

Provisioning

The act of loading a secret into an app, usually by scanning an image.

Frequently Asked Questions

Which apps can scan this QR code?

Any app that supports the otpauth:// URI scheme -- Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, andOTP, and most other TOTP/HOTP authenticator apps. This has been the de facto standard enrollment format since Google Authenticator's original implementation.

Is it safe to generate my 2FA QR code in a browser tool?

This tool builds the QR code entirely client-side -- your label, issuer, and secret never leave your device, and nothing is logged or transmitted. That said, treat the resulting QR code (and any screenshot of it) exactly like a password: anyone who scans it can generate valid codes for your account.

What if my secret isn't Base32?

Most services already give you a Base32 secret when they offer 'manual entry' as an alternative to their own QR code. If you only have a hex or raw-text key, convert it to Base32 first -- or use the TOTP Secret Generator to create a fresh, correctly-formatted one instead.

Can I regenerate the secret without retyping everything else?

Yes -- click the refresh icon inside the Secret field to fill it with a new random Base32 secret while keeping your label, issuer, and other settings exactly as they are.

Do I need to fill in the Advanced Options?

No. Algorithm (SHA1), digits (6), and period (30 seconds) are the universal defaults every authenticator app assumes. Only change them if a specific service's own setup instructions tell you to.