Spaces and lower case are fine. Any text containing a secret works, the key is picked out automatically. Paste several lines and each line becomes its own code.

Advanced options (digits, period, algorithm)
Drop a QR image here Click to choose a file, drag an image in, or paste a screenshot. PNG, JPEG, GIF, WebP and BMP are all accepted. Ctrl + V works anywhere on this page
Uploaded QR image Click, drop or paste another image to replace this one

Paste the value copied from a page as "Copy image" or an inline data: URI. The data: prefix is optional.

Other 2FA tools

Set up two-factor on your own system, or check that a device is producing the right codes.

Create a new secret

Need to set up 2FA on your own system? Generate a fresh key and its QR code.

Check a code

Confirm that a code from a device matches a secret, with an optional drift window.

Common questions

Is my secret sent to the server?

QR images are decoded in your browser when it supports it, so the image never leaves your device. Typed secrets are sent over HTTPS to compute the code, and stored encrypted if you keep the history.

Why does my code differ from my phone?

TOTP depends on the clock. If your phone or server clock drifts by more than a few seconds you will see a different code. Use the drift window when verifying.

Which algorithms are supported?

SHA-1, SHA-256 and SHA-512 with 4 to 10 digits and any period, plus HOTP counters and Steam Guard codes.

How long is the history kept?

Three days by default, and only for signed-in accounts, nothing is stored for guests. To keep a secret for good, put it in the 2FA vault.