Online Authenticator

Add authenticator accounts. Your account data is encrypted and stored locally in this browser, with live TOTP codes generated on the device.

Google Authenticator
Google 2-Step Verification
2FA
TOTP

Loading authenticator…

Authenticator data is encrypted on this device TOTP codes are generated in your browser See the countdown and refresh each code automatically

How to use the online TOTP authenticator

Get an authenticator setup key from your account security settings, then let AuthTool generate time-based codes.

Enable two-step verification

In the account security settings, choose an authenticator app or TOTP and reveal the setup key.

Add a setup key or URI

Choose Manual entry or otpauth URI in the tool, then paste the matching Base32 secret or URI.

Copy the current code

Select an account and copy its live TOTP code to complete sign-in or verification.

Understand Google Authenticator, 2FA, and TOTP

AuthTool is an online authenticator for generating TOTP codes. Add a service-provided Base32 secret or otpauth:// URI, or upload its QR code. Account data is encrypted and stored in this browser, and codes are generated locally.

Google Authenticator

Google Authenticator is the official authenticator app from Google and can generate codes using TOTP. If a service provides a compatible TOTP secret and parameters, AuthTool can generate the corresponding codes.

Google 2-Step Verification

Google 2-Step Verification adds a second sign-in check beyond the password for a Google account. TOTP codes from an authenticator app are one available option; the methods depend on the account security settings.

2FA (Two-Factor Authentication)

2FA stands for Two-Factor Authentication. It verifies identity using factors from two different categories, such as a password and a temporary code from an authenticator.

TOTP (Time-Based One-Time Password)

TOTP is the Time-Based One-Time Password standard. It calculates short-lived codes from a shared secret and the current time window. Codes refresh on the configured period, and authenticator apps such as Google Authenticator can use this standard.

How to generate a TOTP two-factor code

In your service’s two-step verification settings, choose an authenticator app and reveal its setup key. Select Manual entry to enter an account name and Base32 secret, or use the otpauth URI tab to paste and parse a link. Save the account to view codes, then enter a valid code when you sign in.

Enable two-step verification or TOTP authentication in the account security settings.
Copy the Base32 secret or otpauth:// URI, or save the QR image that contains the setup data.
Choose Manual entry or the otpauth URI tab, enter or parse the setup data, and save the account.

How is authenticator data encrypted and stored?

Account names, TOTP secrets, and verification settings are always stored as AES-256-GCM ciphertext in this browser. With password protection on, the browser verifies your password before showing the account list. With it off, a local unlock key opens the list automatically. The password itself is never stored or uploaded. While protection is on, forgotten passwords cannot recover accounts, and data does not sync across devices.

Google Authenticator, 2-Step Verification, 2FA, and TOTP

Google Authenticator: Google’s official authenticator app, which manages time-based verification codes for accounts on a phone.
Google 2-Step Verification: Google’s account security feature that adds a second sign-in step after your password. Available methods depend on the account settings.
2FA: Short for Two-Factor Authentication, a general term for verifying identity with two different factors.
TOTP: Time-based One-Time Password: a standard for short-lived codes computed from a shared secret and the current time window.

Authenticator is a general term. Google Authenticator is Google’s app; Google 2-Step Verification is an account security feature; TOTP is a code standard used by many authenticator apps. This online tool follows TOTP generator rules and is not affiliated with Google.

Frequently asked questions

How often does the code refresh?

Base32 secrets use six-digit codes with a 30-second period by default. If an otpauth URI specifies an algorithm, digit count, or period, the tool follows those settings.

Can it read an authenticator QR code?

Upload a QR image in the add authenticator dialog and your browser will try to decode it locally. If QR detection is not supported, paste a Base32 secret or otpauth URI instead.

Is my setup key stored?

Yes. It is stored as AES-256-GCM ciphertext in this browser and is not uploaded to AuthTool servers. With list password protection on, verify your password before it is decrypted; with protection off, the browser unlocks it automatically. Change this setting below the account list.