How to use a TOTP secret key

A TOTP secret key is the long-term key used to produce short-lived login codes. If you already have the setup key for an account you control, 2FA Live ONLINE can generate its current code.

The key and the code are different

A secret key is usually a long string of letters and numbers. It is sometimes called a setup key or manual entry key. A code is the shorter number you enter during sign-in. Keep the key private: it is used to generate future codes, not just the code showing now.

TOTP combines a shared secret with a time step. The authenticator and the service must agree on the secret and settings, and their clocks must be close enough. The method is described in RFC 6238.

Before you start

Get the setup key from the security settings of the service you are protecting. This website cannot find a key from an email address, username, password, or an old six-digit code. A service may show its setup key only when you first enable an authenticator. If you no longer have it, use that service’s recovery process.

Open the service’s real website yourself and check the address. Never enter a secret into a page sent by someone claiming to need it for support. Use only keys for accounts you own or are authorized to manage.

Generate a code

1. Open the 2FA code generator.
2. Paste your Base32 setup key or complete otpauth://totp/ link into Secret key.
3. Select Generate code. Check the account you are signing in to before using the result.
4. Copy the current code into the service’s verification field. Keep a leading zero if the code has one.
5. If only a few seconds remain, wait for the next code and use it promptly.

The key remains visible in the input field. Avoid screen sharing or leaving the page open on a shared computer. The code changes automatically while the generator is open; copying a code does not pause its timer.

Which settings are supported?

A complete authenticator link can carry the algorithm, digits, period, issuer, and account label. Pasting only its secret drops those extra settings, so prefer the complete link when a service uses non-default values. The generator does not scan QR images or support counter-based HOTP links.

Try the flow without a real secret

Select Try a demo in the generator. It loads a public test key, produces a code, and shows how the timer and copy button work. The demo is useful for learning the interface; it will not sign you in to any of your accounts. Never use its public key to protect an account.

Generating, saving, and sharing

You do not need an account to generate a code. For guest generation, the calculation happens in your browser; simply generating does not save the key on the server. Selecting Save code stores it in your signed-in vault. Creating a share link also sends the key to the server so the link can keep providing current codes. These are separate actions.

Read how accounts and keys are stored before saving a key, or how share links work before giving someone ongoing access. If a code is rejected, follow the invalid-code checklist.