How to set up TOTP two-factor authentication
Set up app-based two-factor authentication with TOTP. Step-by-step, plus a free tool to generate a secret, QR code, and verify codes.
Setting up TOTP 2FA means sharing a secret between the service and your authenticator app once, then proving you hold it with a rotating 6-digit code. Here is the full flow, and how to test it with our free tool.
What you need
An authenticator app (Google Authenticator, Authy, 1Password, or similar) and a service that offers TOTP 2FA. The service generates a secret and shows it as a QR code and a Base32 string.
Testing your own implementation
If you are building 2FA, our TOTP tool lets you generate a secret and otpauth URI, render the QR, watch the live code tick, and verify a pasted code — so you can confirm your server and an authenticator app agree before shipping.
Step by step
In the service’s security settings, choose "Authenticator app" and reveal the QR code.
Open your authenticator app and scan the QR (or type the Base32 secret manually).
The app now shows a 6-digit code that changes every 30 seconds.
Enter the current code back into the service to confirm the secret matches.
Save the backup/recovery codes somewhere safe in case you lose the device.
Try it now — free, no signup
Use the TOTP generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.