How to Get a 2FA Code from a Secret Key: Complete Guide

Two-factor authentication (2FA) has become the security standard on the internet. But what if you have a secret key and no authenticator app? Or if you want to generate codes for multiple accounts at once? The tool above is ready to use: paste one or more Base32 keys and get current 6-digit codes. Below is how it works, why codes change every 30 seconds, and what happens inside the TOTP algorithm.

 

1. What Is 2FA and Why You Need It

Two-factor authentication is a method of protecting an account where you need not only a password but also a second confirmation of identity to log in. Usually this is an SMS code, a push notification, or a one-time code from an authenticator app.

A password can be stolen, guessed, or intercepted through phishing. The second factor solves this problem: even if an attacker gets the password, they cannot log in without the code from your phone. According to Microsoft, 2FA blocks more than 99% of account attacks.

The most common type of second factor is TOTP (Time-based One-Time Password). These are the 6-digit codes that change every 30 seconds in Google Authenticator, Authy, 1Password, and other apps.

 

2. How TOTP Works: The Math Inside

TOTP is described in RFC 6238. It is an extension of the HOTP algorithm (RFC 4226), which generates one-time passwords based on an event counter. TOTP replaces the event counter with the current time.

Here is how it works step by step:

1. Secret key. When setting up 2FA, the server generates a random secret key. This is a Base32-encoded string, usually 16 or 32 characters long. Example: JBSWY3DPEHPK3PXP. This key is shared with you (via QR code) and stored on the server. It is the same for you and the server.

2. Time counter. The current Unix time (seconds since January 1, 1970) is divided by 30. The result is an integer - the number of the current 30-second interval. For example, if it is 12:00:15 now, the Unix time might be 1700000015, divided by 30 gives 56666667. This number is the same for all devices in the world at that moment.

3. HMAC hash. The secret key and the interval number are fed into the HMAC-SHA1 function. HMAC is a keyed hash algorithm. The output is a 20-byte hash. This is where SHA1 is used - the standard algorithm for TOTP, although SHA256 and SHA512 variants exist.

4. Truncation. Only part of the 20-byte hash is used. A special dynamic truncation algorithm selects 4 bytes and converts them to a number. This number is then modulo 10^6 to get a 6-digit code. If the code is shorter than 6 digits, leading zeros are added.

5. Result. You get a 6-digit code like 492039. The server performs the same calculations with its secret key and compares the result with what you entered. If the codes match, access is granted.

All the math takes milliseconds. That is why an authenticator app can generate codes without internet: it only needs the secret key and accurate time.

 

3. Why Codes Change Every 30 Seconds

30 seconds is a compromise between security and convenience. If the code lasted longer, an attacker would have more time to intercept and use it. If it lasted less, users would not have time to enter it.

The server usually accepts not only the current code but also the code from the previous interval to compensate for slight clock desynchronization. This is called a "search window". Usually it is 1-2 intervals in each direction. However, the wider the window, the higher the risk that an old code is still valid.

In the tool above you can see a countdown timer. When it reaches zero, all codes refresh automatically. This happens synchronously with the server because both sides use the same system time.

 

4. What a Secret Key Looks Like

A secret key is a Base32-encoded string. Base32 uses an alphabet of 32 characters: A-Z and 2-7. This is done for convenience: letters and digits are easy to distinguish, no confusion between 0 and O, 1 and I. Key length is usually 16, 26, or 32 characters.

Examples of secret keys:

JBSWY3DPEHPK3PXP
GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
MFRGGZDFMZTWQ2LK

The key is case-sensitive but is usually stored in uppercase. Spaces and hyphens are ignored. If you have a QR code for 2FA setup, it encodes a URL like:

otpauth://totp/Example:user@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example

The secret parameter in this URL is your secret key.

 

5. Where to Get a Secret Key

When you enable 2FA on a service (Google, GitHub, Discord, a bank), you are shown a QR code. Inside that QR code is a URL with the secret key. The authenticator app scans the QR code and extracts the key.

If you want to get the key manually:

On the 2FA setup page, find the link "Can't scan?" or "Enter key manually". The secret key will be shown as text.

Or scan the QR code with any QR reader and find the secret= parameter in the result.

Save the key in a safe place. If you lose your phone but have the key, you can generate codes on any device.

 

6. Security: What to Remember

The secret key is essentially a second password. Anyone who gets your key can generate valid 2FA codes. Therefore:

Do not share your secret key with third parties.

Do not paste the key on untrusted websites or in suspicious apps.

Do not store the key in plain text in notes, messengers, or cloud storage without encryption.

The tool on this page works entirely in your browser. Keys are not sent to a server, not saved, and not logged. You can verify this by disconnecting from the internet after the page loads: the tool will keep working.

If you suspect the key is compromised, immediately disable 2FA on the service and set it up again with a new key.

 

7. FAQ

Why doesn't the code match my app? Check the time on your device. TOTP depends on accurate time. If the clock is off by more than 30 seconds, codes will differ. Enable automatic time synchronization.

Can I use one key for multiple accounts? No, each account has its own unique secret key. If you use one key for two services, the codes will be the same, but this is insecure: compromising one key affects both accounts.

What if I lost my key? If you have no backup codes, recovering access will be difficult. Contact the service support. In the future, always save the backup codes provided during 2FA setup.

Does TOTP work without internet? Yes, generating a code does not require a network connection. Only the secret key and accurate time are needed. Internet is only needed for the server to accept the code.

What algorithm is used by default? SHA1. Although SHA1 is considered outdated for some tasks, in TOTP it is still the de facto standard because all common authenticators support it. SHA256 and SHA512 are used less often.

 

Conclusion

TOTP is an elegant and reliable method of two-factor authentication. It works on a shared secret key and current time, requires no internet, and is easy to implement in any programming language. The tool above lets you quickly generate codes for one or multiple accounts without installing extra apps. The main thing is to remember that the secret key is equivalent to a password and must be handled just as carefully.

Keywords: 2FA code from secret key, TOTP generator, 2FA secret key, how to get 2FA code, TOTP online, one-time password generator, Base32 2FA key, RFC 6238, two-factor authentication.