How it works
The key and the current time step are combined with HMAC (SHA-1, SHA-256 or SHA-512), then truncated to a 6- or 8-digit number — the TOTP method of RFC 6238. Paste an otpauth:// link and digits, period and algorithm are set for you. Your device clock needs to be roughly right.
secret + time ÷ 30 → HMAC-SHA1 → 6 digits
Where is the secret?
- New setup: the site shows “can't scan?” or “enter manually” next to the QR code — that string is the secret.
- Spaces and dashes in the secret are ignored, and lowercase works too.
- Lost secret: this page cannot recover it. Re-register two-factor on the site to get a new one.
Tips
- Use this as a backup viewer, not your only copy — keep the secret in a password manager too.
- If codes are always rejected, check your device clock first.
- Everything runs in your browser; nothing is uploaded.
Standards and sources
- Time-based one-time passwords (TOTP): RFC 6238; the HMAC core: RFC 4226
- Base32 encoding: RFC 4648
Last reviewed October 12, 2026
Frequently asked questions
Where do I find the secret?
When a site shows you a QR code for two-factor setup, there is usually a “can't scan?” or “enter manually” link next to it — that string is the secret.
Why are my codes always rejected?
Almost always the clock: TOTP depends on time, so a device minutes off produces wrong codes. Check automatic date and time first.
Is it safe to paste my secret here?
The page works fully offline and the secret never leaves your browser. Still, treat this as a backup viewer and keep the secret in a password manager too.
What if I lose the secret?
Nothing here can recover it. Turn two-factor off and on again on the site to get a fresh secret.