How the 2FA code generator works
A 2FA secret key is the text behind the QR code a site shows when you turn on two-factor authentication with an authenticator app. From the key and the current time, this page computes the same 6-digit code as Google Authenticator, Microsoft Authenticator or Authy: they all use the TOTP standard (RFC 6238). The code changes every 30 seconds, and the page updates it by itself.
Where to find your 2FA secret key
When you set up two-factor authentication with an authentication app, the site shows a QR code. The secret key is the same thing as text, usually right under the QR code or behind a link like “Can't scan it?”. It looks like JBSW Y3DP EHPK 3PXP: letters A–Z and digits 2–7. Spaces and letter case don't matter.
Accounts that come in bulk usually have the key inside a line such as login|password|key|email. Paste the whole line: the page finds the key and shows the login next to the code.
Codes for several accounts at once
Click Several keys or paste several lines at once. Each line can be:
- a key, with or without spaces:
JBSWY3DPEHPK3PXP; - an account line:
login|password|keyoremail:password:key; - an
otpauth://link from a QR code; - several keys separated by commas.
All codes update together, and Copy all copies them with the logins.
Why a 2FA code doesn't work
- The clock is off. Codes depend on the time on your device. Turn on automatic date and time and try again.
- The code expired. If only a few seconds are left, wait for the next one.
- It's not the right key. A key has only letters A–Z and digits 2–7. Backup codes and SMS codes are something else.
- Different settings. Some sites use 8 digits or a 60-second step. The page reads them from
otpauth://links.
Open a code in one click
A link like https://accovod.com/2fa/#JBSWY3DPEHPK3PXP opens the page with the code ready. The part after # is never sent to a server, and the page removes it from the address bar right away. Keep such links where you keep passwords: whoever has the key can generate your codes.
FAQ
Is it safe to paste my 2FA key here?
The page computes codes with JavaScript in your browser and doesn't send keys anywhere. Still, a 2FA key is as sensitive as a password: whoever has it can generate your codes.
Will the code match Google Authenticator?
Yes. Both use the same standard, so the same key gives the same code at the same moment.
Does it work without the internet?
Once the page has loaded, yes: codes are computed on your device.