Secure password generator: three strong random passwords or a passphrase of real words, each with its entropy and time to crack. Free, nothing stored.
Two-factor authenticator (TOTP)
Two-factor authenticator in your browser, from the secret a service shows at setup. A bookmark and your passkey are the key: nothing stored, no app.
Paste the secret a service shows when you switch on two-factor authentication — the text under the QR code, or the otpauth:// address inside it — and get the six-digit code it expects, right now, in your browser. Then make a bookmark: the secret is sealed in the address under your passkey, nothing is stored anywhere, and there is no account to create.
What it does, and why it is here
Most services protect a login with a second factor: a code that changes every thirty seconds, computed from a secret you and the service share. The usual place to keep that secret is an app on a phone. That works until the phone is not there — a test account on a shared machine, a service you only use from one laptop, a colleague who needs the code once, a phone being replaced.
This tool computes the same codes, from the same standard (TOTP, RFC 6238), without an app and without an account. It has two ways of working, and the difference between them is the whole point.
The generator is the form on this page. It sends the secret once to compute the code, and keeps nothing. Use it for a test account, or to check that a secret is the right one.
The bookmark never sends the secret at all. Press Make the bookmark with my passkey and your browser encrypts the secret under a key that only your passkey can produce, then writes it after the # of an address. Bookmark that address: opening it and confirming with your passkey shows the code. The server serves the page, and never sees what follows the #.
How it works
A TOTP code is a keyed hash of the current thirty-second slot, computed with the secret and reduced to six digits. Anyone holding the secret can compute it, which is why the secret is the thing to protect.
A bookmark's address has two halves. The path — fastast.com/tools/authenticator/github — names a template: the service's name and the shape of its codes (algorithm, digits, period). It is the same for everyone who uses that service, so it carries nothing about you. What follows the # is your enrolment: the secret and the account label, encrypted with AES-GCM under a 256-bit key derived from your passkey through the WebAuthn PRF extension, with a fresh salt for every bookmark. A browser never sends the part after # with a request, so the server receives the path and nothing else.
The passkey is what makes the address safe to keep in a bookmark. Without it, the encrypted part is noise: there is no PIN to guess and nothing to brute-force offline. The passkey itself is guarded by your device — fingerprint, face, or the device's own code — and, when it is a synced passkey, follows you to your other devices.
What you fill in
- Service — which service the secret belongs to. Picking it sets the shape of the codes; nearly every service uses the standard one (SHA-1, six digits, thirty seconds), so Any service is right whenever yours is not listed. If you paste an
otpauth://address that names a listed service, it is picked for you. - Account — how the service names you: an e-mail, a username. A label, so that two bookmarks for the same service can be told apart. Optional; an
otpauth://address carries its own. - Secret — the key the service shows next to its QR code, in base32 (letters A to Z and digits 2 to 7; spaces, hyphens and case do not matter), or the whole
otpauth://totp/…address the QR code contains. Required. Counter-based secrets (otpauth://hotp/) and Google Authenticator's export batches are refused rather than misread. - Algorithm, digits, validity — under When the service departs from the standard. Leave them at As the service does unless the service told you otherwise; an address that says
digits=8oralgorithm=SHA256is read by itself.
What you get back
- The current code, with a copy button, and the seconds it stays valid. With JavaScript the code renews itself on the page; without it, press the button again.
- The next code, for the moment when a few seconds remain and typing would take longer than that.
- The shape it was computed under — algorithm, digits, period, service, account — so that a code the service refuses can be traced to a wrong setting rather than to the secret.
- The size of the secret, in bits. Enrolment keys are 80 to 160 bits; a much smaller number means only a part of the key was pasted.
- The bookmark address, when you make one, with a copy button and a link to open it. Bookmark the page it opens.
Where everything lives, and who can see it
| What | Where it is | Who can see it |
|---|---|---|
| The secret, when you press Get the code | Sent once over HTTPS, used to compute the code, then dropped. Not written to any store or log. | This server, for the duration of the request. Nobody afterwards. |
| The secret, when you make a bookmark | Encrypted in your browser and written after the # of the bookmark address. Never sent. | Only a browser holding your passkey, after you confirm. |
| The passkey | Your device's secure hardware, or your platform's passkey manager (iCloud Keychain, Google Password Manager, a hardware key). Never on this server. | Nobody. It answers a challenge; it never leaves. |
The path of a bookmark, such as /tools/authenticator/github | Sent with every visit, like any address. | This server: it learns that someone opened a GitHub authenticator, not who, not which account, not any code. The visit is counted from the server's log line, which carries the path and never the part after #. |
| The whole bookmark address | Your browser's bookmarks and history, and their sync if you use one. | Whoever can read your browser profile. They get the encrypted part, useless without your passkey — but treat the address as private all the same. |
| The codes | Computed in your browser (bookmark) or on the server (generator), shown on the page, never kept. | You, and whoever is looking at your screen. |
| An account, a cookie, a session | None. There is nothing to sign up for. | — |
What it is for
- A second factor for a service you only use from a computer — no phone to reach for; the bookmark and your fingerprint do it.
- Test and staging accounts — paste the secret, read the code; nothing to enrol on a phone that will be reset next week.
- Checking an enrolment — a service refuses your codes: paste the secret here and compare. If the codes match, the clock or the secret on the other side is wrong; if they do not, a setting (digits, algorithm) is.
- A spare — when you enrol on a phone, make a bookmark from the same QR code and keep it in a folder. The day the phone is lost, the bookmark still works on any device where your passkey is.
- An authenticator on a shared or locked-down machine — nothing to install; the page is the app.
What it does not do
- It does not store anything — so it cannot list your authenticators, search them, or get them back. Each bookmark is on its own; lose it and you re-enrol with the service, using the recovery codes it gave you. Keep those.
- It does not read QR codes from a camera or an image. Paste the address or the key the service shows under the QR code.
- It does not compute counter-based codes (HOTP), nor Steam's or Blizzard's proprietary ones.
- It does not replace your passkey: a bookmark made here opens only with the passkey that made it. A hardware key that stays in a drawer keeps the bookmark in the drawer too.
- The bookmark needs a recent browser: passkeys with the PRF extension, which Chrome, Edge, Safari 18 and Firefox 135 and later provide, over HTTPS. Elsewhere, the generator still works.
- It is a beta. The format of the address is versioned so that a bookmark made today keeps opening, but the page is young: keep the recovery codes of every service you enrol here.
Questions
Is the secret really never sent when I make a bookmark?
Yes. The bookmark is composed by the script on this page, in your browser: the secret is encrypted there and written after the #, a part a browser never includes in a request. If you also press Get the code, that press sends the secret once — to compute the code, and nothing more.
Why a passkey and not a PIN?
A bookmark can leak — through history, through sync, through a copy pasted in the wrong chat. Anything protected by a four-digit PIN alone can then be tried ten thousand times offline, in a few hours. A passkey's secret cannot be extracted from the address: it lives in your device and only ever answers a prompt you confirm.
Can I open the bookmark on another device?
Yes, if the passkey is there: synced passkeys (iCloud Keychain, Google Password Manager, a password manager that stores passkeys) follow you; a hardware key has to be plugged in. Bookmark sync carries the address; the passkey carries the key.
What does the server learn when I open a bookmark?
The path: which template, at what time, from which network address — the line every web server writes. Not the account, not the secret, not the code.
The service says my code is wrong. What now?
Check the clock of the device first: a code is computed from the time, and a clock two minutes off yields codes the service refused two minutes ago. Then check the settings the service gave you: a few use eight digits or SHA-256, and the answer says which shape it used.
Can I use it for several accounts?
One bookmark per account, in a folder. Each carries its own secret and label, and they all share the passkey.
Sources and further reading
Explore
More tools like this one
Picked from the catalog by what this page is about — the closest ones first. Each tag opens its whole family.
Free WiFi QR code: guests scan it and their phone offers to join, no key to spell out. Print a guest card or a sheet for several networks. Nothing stored.