How do I add 2FA (Google Authenticator) to my app?
Generates a TOTP secret for 2FA: a random key + ready-to-scan QR code for Google Authenticator, Authy, 1Password, Microsoft Authenticator, Aegis.
The RFC 6238 standard: 160-bit base32 secret + the standard "otpauth://totp/..." URI used by every popular 2FA app.
Perfect for adding 2FA to your own app, testing integrations, migrating 2FA between authenticators.
How to use it
- "Issuer" = app/service name (e.g. "MyService", "Bank ABC"). Shows up as the title in Authenticator.
- "Account" = user identifier (e.g. "jan@company.com"). Shows under the issuer.
- Leave the defaults SHA-1, 6 digits, 30s, the industry standard. Every popular Authenticator supports it.
- Scan the QR with the Authenticator app on your phone. Or copy the secret and type it as "Setup Key".
- The phone starts showing 6-digit codes refreshing every 30s.
- Save the secret somewhere safe (paper, password manager). Without it, if you lose the phone, you can't recover. Also generate backup codes for extra protection.
When this is useful
Four typical situations where a TOTP secret generator solves a concrete problem:
- Building your own app with 2FA. Generate a per-user secret, store it server-side; here you can test the flow before plugging in a library like otplib/speakeasy.
- Migrating Google Authenticator → Authy/1Password/Aegis. Import via QR.
- Adding 2FA to tools that don't natively support it (your own VPS, private services via SSH-OTP).
- Education. See exactly what an otpauth URI looks like, what fields are required, how base32 encodes the secret.
For end users: if a service (Google, GitHub) generates a QR for you, you don't need this tool, use their built-in flow.
Questions and answers
TOTP (Time-based One-Time Password): the RFC 6238 standard for two-factor authentication. The Authenticator app stores a shared secret with the server; every 30 seconds it computes a 6-digit code from the secret + current time. The server does the same and compares. An attacker who knows your password but doesn't have the Authenticator phone can't log in.