Short answer: a browser-based TOTP generator produces exactly the same codes as Google Authenticator, because it runs the same published algorithm. The cryptography is not the weak point. The real question is where your secret key ends up — and that depends on whether the tool sends it to a server, and on how you handle it afterwards.
This guide explains what actually creates risk, how to check any online 2FA tool for yourself, and when you should use a phone app or hardware key instead.
What a 2FA code generator actually does
A TOTP code is not stored anywhere or fetched from a server. It is calculated. The formula takes two inputs:
- Your secret key — the string of letters and numbers the site gave you at setup.
- The current time, rounded down into 30-second blocks.
Those two values go through HMAC-SHA1, and the result is truncated to six digits. That is the entire process, defined publicly in RFC 6238.
This matters for one reason: because the code is derived purely from your key and the clock, any correct implementation produces identical output. A phone app has no cryptographic advantage over a browser. Google Authenticator, Authy, 1Password, and a web tool all return the same six digits at the same moment for the same key.
So where does the risk actually come from?
Three places, none of them the maths.
1. Whether the key reaches a server
This is the one that matters most. If a website sends your secret key to its backend to compute the code, that site now holds a permanent credential to your account — and so does anyone who breaches it. A key is not like a password you can rotate casually; it is the seed for every future code.
A properly built tool computes everything in JavaScript on your device. The key never leaves the browser tab. Our own 2FA code generator works this way, and the section below explains how to verify that claim rather than take it on faith.
2. Shared devices and browser history
Even with a perfectly client-side tool, pasting a secret key into a public library computer or a shared work machine is a bad idea. Autofill, clipboard managers, browser extensions, and screen-recording software all sit between your keyboard and the page.
3. Defeating the point of “two” factors
This is the subtle one. Two-factor authentication assumes your password and your second factor are separate. If your password manager is open in one tab and your 2FA key is sitting in another tab on the same laptop, a single compromised device gives an attacker both. You have not really got two factors any more — you have one factor stored twice.
That is a genuine argument for keeping your everyday codes on a separate phone, in a dedicated authenticator app. It is not an argument that browser cryptography is broken.
How to check whether an online 2FA tool is client-side
You do not have to trust anyone’s marketing. You can verify it in about thirty seconds:
- Open your browser’s developer tools (F12 or Ctrl+Shift+I) and select the Network tab.
- Clear the log, then paste a test key and generate a code.
- Look at what requests fired. If your key appears in any outgoing request body or URL, the tool is sending it to a server. Close the tab.
- Stronger test: disconnect from the internet entirely, then generate a code. A genuinely client-side tool still works offline. A server-side one cannot.
The offline test is the one that cannot be faked.
When a web-based generator is a reasonable choice
- Your phone is lost, broken, or dead and you need into an account today. See our guide on recovering accounts after losing a 2FA phone.
- You manage many low-stakes accounts — agency logins, client dashboards, test environments — where entering codes one phone-tap at a time is genuinely wasteful.
- You are on a desktop and your authenticator app has no desktop version, which is still true of Google Authenticator.
- You are verifying that a key works during setup before committing it to your main app, which is also when you may need to enter a setup key manually.
When you should not use one
- Your primary email account. Email is the master key to everything else, because most password resets flow through it.
- Banking and crypto exchanges. These deserve a hardware key or a dedicated device. A blockchain transaction cannot be reversed.
- On any device that is not yours. No exceptions worth making here.
- Anywhere a passkey is offered instead. Passkeys are phishing-resistant in a way TOTP is not — see below.
The honest limitation of all TOTP, everywhere
Worth stating plainly, because most articles on this topic skip it: TOTP does not protect you from a convincing phishing site.
If you are tricked into typing your password and your six-digit code into a fake login page, an attacker can relay both to the real site within the 30-second window. This is not a flaw in web generators — it applies identically to Google Authenticator, Authy, and every other TOTP app. It is a limitation of the shared-secret model itself.
The technology that fixes this is FIDO2 and passkeys, which cryptographically bind your login to the real domain, so a fake site simply cannot use them. NIST SP 800-63B reflects this in its guidance on authenticator strength. Where a service offers passkeys, take them. Where it does not, TOTP remains far better than a password alone or SMS codes.
Frequently asked questions
Is an online 2FA generator as secure as Google Authenticator?
Cryptographically, yes — both implement RFC 6238 and produce identical codes. The difference is operational: a phone app keeps your key on a separate device from the browser you log in with, which limits the damage if your computer is compromised. The underlying standard has a counter-based sibling, explained in our comparison of TOTP and HOTP.
Can a website steal my 2FA secret key?
Only if it transmits the key to its server. Check the Network tab in developer tools, or test whether the tool still generates codes with your internet disconnected. If it works offline, the key is not going anywhere.
What happens if someone gets my secret key?
They can generate valid codes for that account indefinitely. Treat a leaked key as a full compromise: go into the account’s security settings, disable 2FA, and set it up again from scratch to issue a new key. Changing your password alone is not enough.
Does using a web generator mean my accounts are less protected?
Compared to a password alone, you are dramatically better protected either way. Compared to a phone app, you lose device separation. Compared to a passkey, you lose phishing resistance. Match the method to what the account is worth.
Are the codes stored anywhere after I generate them?
On a client-side tool, no. The code exists in your browser’s memory for the 30 seconds it is valid and is then discarded. Nothing is written to a database.
The bottom line
An online 2FA code generator is safe when it is genuinely client-side, when you are on your own device, and when the account is not your email or your money. Verify the client-side claim yourself with the offline test — it takes seconds and settles the question permanently.
New to all of this? Start with our explainer on what two-factor authentication is and how it works, or compare the best Google Authenticator alternatives if you would rather use a dedicated app.