It takes either form
A bare secret key is the usual case. If you were given a full otpauth link instead, paste that and the secret is read out of it for you. Both produce the same result because the link is only a wrapper around the same key.
2FA Code Generator
Get your Google Authenticator (2FA) code instantly. Compatible with any service requiring 2FA.
Security Note
Your secret key is processed locally in your browser. It is never sent to our servers.
What it does
A Secret Key In, the Current Code Out
A 2fa code generator does not look a code up, because there is nothing to look up. Two-factor codes are not stored anywhere and are not sent to you. They are calculated, continuously, from one secret and the clock. Anything holding that secret can produce the same code at the same moment.
It shows the time left
The code rolls on a fixed cycle, so a code copied with two seconds remaining will often be refused by the time you paste it. The countdown beside the code is there to stop that, and waiting for a fresh one costs nothing.
Nothing is kept
The calculation happens in your browser. No secret is stored and none is needed after you close the tab. That also means nothing here can recover a key you lose.
Why this page exists
A Quarter of One Shelf Already Sends You Somewhere Else For This
This is not a general-purpose utility that happened to land on a marketplace. It closes a gap the catalogue itself creates.
The listings hand over a key, not a code
Of the live Facebook listings on this site, most mention two-factor authentication and a substantial minority name a third-party generator inside their own delivery notes. The seller gives you a secret because that is the durable thing; the code is what you have to make from it, every time you sign in.
A key is not the same as access
A listing can advertise 2FA and still not give you the secret, which leaves you locked out of the second step rather than protected by it. Read for the word key or secret specifically, not for the phrase two-factor, and treat a listing that promises the feature without the key as promising nothing.
Three things people confuse
Secret Key, Recovery Address, Phone Number
These are separate items and a listing can include any one without the others. Which ones you get decides whether you can hold the account or only open it once.
| What it is | What it does not do | |
|---|---|---|
| Secret key | The string this page turns into codes. Whoever holds it can generate valid codes indefinitely. | Does not let you reset the account, and does not stop the previous holder generating the same codes from their copy. |
| Recovery address | The mailbox a reset link goes to. This is the item that decides who can take the account back. | Does not produce codes, and is often the field a listing quietly leaves out. |
| Phone number | A second channel some services fall back to, and sometimes the thing a listing advertises as removed rather than included. | Does not produce codes either, and a number you do not physically hold is not a channel you control. |
A secret you were given is a secret somebody else has seen. If the account matters to you, replace the key with one of your own once you are in, rather than carrying the seller's. That is the only step that ends their ability to produce the same codes, and on most services it takes less than a minute.
Limits
What This Cannot Do For You
Stated plainly, because a tool that implies more than it does is worse than no tool.
It cannot recover a lost key
Nothing is stored here. If the secret is gone, this page cannot help and neither can any other generator. Recovery, where it exists at all, runs through the service that issued the account.
It cannot tell you the key is yours alone
A correct code proves the key works. It proves nothing about how many copies of that key exist. That question is answered by replacing the key, not by testing it.