Secure TOTP generation
RFC 6238 compliant codes generated from your encrypted secrets — never stored in plain text.
RFC 6238 · AES-256-GCM · Server-side only
Secure TOTP Authenticator
Generate secure two-factor authentication codes and manage your authenticator accounts in one place.
Try it now
Paste any TOTP secret key below to generate a real 6-digit code instantly — right in your browser.
Your secret is processed entirely in your browser. If you are not logged in, it is stored on your device and saved to your account automatically after you log in or sign up.
Powerful features
Fast 6-digit codes
Standard 6-digit codes with SHA-1 support, ready the moment you open your dashboard.
30-second automatic refresh
Codes refresh automatically every 30 seconds with a live countdown so you are never caught out.
Multiple account support
Add as many authenticator accounts as you need — social media, email, finance and more.
Secure encrypted storage
Every TOTP secret is encrypted with AES-256-GCM before it is stored on our servers.
Mobile-friendly dashboard
A responsive, touch-friendly dashboard that works beautifully from 320px phones to 4K screens.
Security First
Your passwords are securely hashed and your TOTP secrets are encrypted before being stored.
- Passwords are hashed with bcrypt before being stored — never saved as plain text.
- TOTP secrets are encrypted with AES-256-GCM using a server-only encryption key.
- Your secret key is only decrypted on the server, inside a single request, when generating a code.
- Session cookies are HTTP-only and Secure, and never exposed to client-side JavaScript.
- You can only ever access your own accounts — each request is authorized server-side.
- Rate limiting protects the authentication endpoints from brute-force attacks.
Ready to secure your accounts?
Create a free account and start generating two-factor authentication codes in seconds.