You can generate two-factor authentication codes without installing anything. A free online 2FA authenticator runs entirely in your browser: open the free 2FA code generator, paste the secret key from your account's security settings, and it shows the same six-digit TOTP code that Google Authenticator would — refreshed every 30 seconds, with no download, no signup and no cost.
That makes a browser-based generator a useful fallback when an app isn't an option: you're on a locked-down work laptop, or your phone is lost, broken or flat. Here's how the codes are made, how to use a web authenticator step by step, and when an app or hardware key is the smarter choice.
How TOTP codes actually work
TOTP stands for time-based one-time password — the open standard behind most “enter the six-digit code” prompts. When you switch on 2FA, the service creates a shared secret and shows it as a QR code, usually with a text version underneath. An authenticator combines that secret with the current time and hashes the two together, producing a short code that changes every 30 seconds. The service runs the same calculation on its side; if your code matches, you're in. For a plain-English walkthrough, see our explainer on what a TOTP code is.
Because TOTP is a standard rather than a product, any compliant generator works with any compliant service. Google, GitHub, Microsoft, Amazon and thousands of smaller sites accept codes from whichever tool you prefer — a phone app, a hardware token or a page in your browser.
Using a web authenticator, step by step
- Start 2FA setup on the site you're protecting. When the QR code appears, look for a link such as “can't scan the code?” or “enter the key manually”, then copy the secret key — or the full
otpauth://address if one is shown. - Open the web generator. The tool at 2fa.1mail.lt runs fully client-side on your browser's built-in Web Crypto engine, so the secret is processed on your device and never sent to or stored on any server.
- Paste the secret (or the otpauth link) into the input field. The current six-digit code appears instantly, with a countdown to the next refresh.
- Enter the code on the website to confirm setup or sign in, before the timer runs out.
One side tip: if you're creating a throwaway account just to test a new service, sign up with a disposable address from 1mail.lt's temporary email instead of your real inbox — you can try the whole 2FA flow without adding your main address to another mailing list.
When an app or hardware key is better
A browser generator is a fallback and a convenience — it shouldn't be the whole plan for your most important accounts.
- Everyday logins: a phone app stores your secrets encrypted, so codes are two taps away instead of a paste each time.
- High-value accounts: for primary email, banking and anything tied to money or identity, use an app with encrypted backups — or a hardware security key, which also resists phishing.
- Shared computers: avoid pasting 2FA secrets on machines you don't control, where malware or clipboard tools could capture them.
Remember, too, that 2FA is the second lock, not a substitute for the first. A weak or reused password is still the easiest way to lose an account, so pair your codes with a strong, unique password from a free password generator — or learn how to create a strong passphrase you can actually remember.
Honest limitations and safety notes
- Keep your backup codes. Every service that offers TOTP also issues one-time recovery codes during setup. Store them somewhere safe — they're your way back in if the secret is gone.
- The browser doesn't remember. A client-side tool keeps nothing between visits, so you'll paste the secret again next time unless you save the key yourself, ideally in a password manager entry next to that account's password.
- Treat the secret like a password. Anyone who copies the key can generate your codes indefinitely. Don't email it to yourself or leave it in an unencrypted note.
- Skip shared machines for critical accounts. A borrowed computer is fine for a low-stakes login in a pinch; banking and primary email deserve hardware you trust.
Frequently asked questions
Is an online 2FA authenticator safe?
A properly built one is, within limits. 2fa.1mail.lt does all its work locally in your browser; secrets are never transmitted or stored server-side. The remaining risk is the device itself — malware or someone watching your screen — which is why sensitive accounts belong on hardware you trust.
Does it work with Google, GitHub and Microsoft accounts?
Yes. Any service offering the standard “authenticator app” option uses TOTP, so a standards-compliant generator can produce its codes. Some services default to push notifications in their own apps; pick the authenticator-app or manual-entry option during setup instead.
What if I lose the secret key?
Sign in with one of your backup codes, then disable and re-enable 2FA to get a fresh secret. Without the key or backup codes, you're left with the service's account-recovery process — slower, and not guaranteed.
Do I need to create an account?
No. There's no registration and nothing stored — you open the page, paste a secret and read your code.
Generate your first code
Next time a login asks for a code and your phone is out of reach, don't install anything. Copy your secret key, open the free online 2FA authenticator and you'll have a working code in seconds — no account, and your secrets never leave your device.
