Guides

2FA codes

Works with any authenticator secret: typed, scanned from an image, or pasted as base64 data.

Three ways to feed in a secret

1. Secret or link: paste the base32 key (JBSWY3DPEHPK3PXP), a full otpauth:// link, or even a whole block of text that contains one. The key is picked out for you.
2. QR image: click the drop area, drag an image in, or press Ctrl+V anywhere on the page after taking a screenshot.
3. Base64 data: paste the raw data:image/png;base64 string that many sites put on the clipboard when you choose "copy image".

Where the work happens

Browsers that ship the BarcodeDetector API (Chrome, Edge, Opera) read the QR code locally: the picture never leaves your machine, only the decoded text is sent so the server can compute the code. Other browsers fall back to server-side decoding over HTTPS.

Supported parameters

Recent on this browser

Every code you generate is kept for 3 days without any sign-in. Recognition works in three layers: a long-lived cookie, a copy of the same id in localStorage for when cookies get cleared, and a soft fingerprint (browser, language, IP network) to reconnect a device that lost both.

Secrets in the history are encrypted with AES-256-GCM before they touch the database, and rows older than the retention window are deleted automatically. Clearing the history removes them immediately.

Password generator

Everything is generated with a cryptographically secure random source. Your settings are remembered on this browser for six months.

Your options are remembered on this browser for 180 days, and follow your account once you sign in.

Text tools

Paste a list, choose an operation, get the result. Everything runs on demand and nothing is stored.

Bulk 2FA codes

Paste one entry per line. All of these work:

JBSWY3DPEHPK3PXP
github|JBSWY3DPEHPK3PXP
[email protected]|hunter2|JBSWY3DPEHPK3PXP
otpauth://totp/GitHub:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=GitHub

The separator is detected automatically, and the longest valid base32 field on the line is treated as the secret, so account lists with a password column in the middle still work. Results export to CSV.

IP & DNS

• IP lookup: version, type, reverse DNS, and geolocation with a map when enabled.
• DNS records: A, AAAA, MX, NS, TXT, SOA, CNAME and CAA with their TTLs.
• WHOIS: asks IANA which server owns the TLD, then queries it and the registrar.
• Port check: open or closed, by TCP connection (16 ports per run) or by UDP probe carrying a real service payload (10 ports per run).
• TCP latency: TCP handshake timing, because PHP cannot send ICMP pings without root.
• Spam blacklists: checks an IPv4 address against six well known DNSBLs.
• Mail security: SPF, DMARC, MX, MTA-STS and TLS-RPT records for a domain.

2FA vault

Secrets are encrypted before they are stored. QR images are never kept, only the text they contain.

• Add entries by pasting a secret or an otpauth link, or straight from a QR image.
• Images are converted to text on the spot: the picture itself is never stored.
• Export a QR at any time to move an account onto a new phone.
• Back up to otpauth text, JSON or CSV; import accepts all three plus plain secrets.
• Revealing a secret asks for your password again.

Password vault

Your logins, encrypted before they are stored. Only you can read them back.

• Passwords, notes and any attached 2FA secret are encrypted with AES-256-GCM before they are stored.
• The list only shows a few characters at each end so you can recognise an entry, never the password itself.
• Copy puts the password on the clipboard without showing it; revealing it asks for your account password again.
• Each entry can carry its own 2FA secret, and then the six-digit code appears next to the password.
• A summary panel counts weak passwords, ones reused from another entry, and ones untouched for over a year.
• Imports CSV files exported from Chrome, Firefox, Bitwarden, LastPass or 1Password: their column names are recognised automatically.

What each tool does

The full list of 24 tools, grouped by the job you are doing. It is built from the tool catalogue in the source, so it never drifts from the running version. Most compute entirely on this server and keep working with the Internet down; the ones that must ask outside are listed in full in the Privacy policy.

Security & authentication

Read and build standards-shaped things: TOTP codes per RFC 6238, JWTs split into three parts with expiry, QR codes read from an image or built fresh. No secret leaves this server.

• 2FA codes , Paste a secret or a QR image and get the 2FA code.
• Code reader , Read QR codes from an image or straight from the camera.
• Password generator , Generate strong passwords and score their strength.
• JWT decoder , Split a JWT into three parts, read the claims and check the signature.
• QR generator , Create a QR code from any text or link.

Network & domains

IPv4 and IPv6 subnetting (mask, range, broadcast, VLSM, CIDR aggregation, arbitrary range to CIDR), MAC vendor lookup against the IEEE tables kept on disk, EUI-64 construction, and decoding of IPv6 addresses with IPv4 embedded, 6to4, Teredo, NAT64.

• IP lookup , See your own IP and look up any address.
• DNS records , Look up A, AAAA, MX, TXT and NS records for a domain.
• Subnet & CIDR , Work out IPv4/IPv6 blocks: mask, host range, subnetting.
• MAC lookup , Find the vendor behind a MAC address, reformat it, build the EUI-64.
• WHOIS , Who registered this domain or IP range, and until when.
• Port check , Probe common TCP/UDP ports to see which are open.
• TCP latency , Measure latency to a host with a TCP handshake.
• Proxy checker , Check whether HTTP, SOCKS4 and SOCKS5 proxies are alive and how well they hide your address.
• SSL/TLS check , Inspect a TLS certificate: days left, name match, and which TLS versions the server takes.
• Reverse IP lookup , Find the domains that point at one IP address.
• Spam blacklists , Check whether an address sits on anti-spam blocklists.
• Mail security , Check a domain SPF, DMARC, MX and MTA-STS records.

Conversion & calculation

Number bases alongside how a machine actually stores the value: two’s complement, one’s complement, sign-magnitude, excess-K, IEEE 754 half/single/double, byte order, Base32/58/64/85. Unit conversion across 232 units. Date arithmetic, cron expressions read back in plain words, and colour conversion through sRGB, HSL, OKLCH and CIE Lab with WCAG contrast checks.

• Unit converter , Convert units: length, mass, temperature, data size and more.
• Number base converter , Convert between binary, octal, decimal, hex and read the bits.
• Time converter , Convert Unix timestamps to dates and between time zones.
• Colour converter , Convert HEX, RGB, HSL and CMYK, and score WCAG contrast.

Data & text

Clean and transform text line by line, generate UUID v1/v3/v4/v5/v7 and ULID identifiers, hash, and encode or decode the common formats.

• Text tools , Sort, filter, encode and hash text in bulk.
• ID generator , Generate UUIDs, ULIDs and Nano IDs, or inspect an existing one.
• Cron reader , Explain a cron expression and list its next runs.

Each tool accepts several ways of writing the same thing, Cisco-style MAC addresses, inverted netmasks, 0x-prefixed numbers, dates written in words, so in most cases you can paste and go.

API reference

Every tool is reachable over JSON with a personal API key. Full reference →

curl -s https://authbeta.com/api/v1/totp \
  -H "Authorization: Bearer ab_your_key" \
  -H "Content-Type: application/json" \
  -d '{"secret":"JBSWY3DPEHPK3PXP"}'

Security notes

• A 2FA secret is as sensitive as a password: anyone holding it can mint valid codes forever.
• Storing secrets on a server, here or anywhere, trades some of the second-factor idea for convenience. For high-value accounts, keep the secret only on a device you control.
• Secrets are encrypted with AES-256-GCM using the key in config/config.php. Losing that key makes stored secrets unrecoverable; leaking it exposes them.
• Always run this site over HTTPS. Codes and secrets travel in request bodies.
• Turn on two-factor for your own account here as well: it protects the vault.