2FA Safe Key Generator

Q: Why is Base32 used instead of normal text?

Base32 encoding avoids visually similar characters to prevent human error when manually typing a shared secret key into an authenticator device.

Q: What is the recommended key length for security?

It is strongly recommended to use a key length of 32 characters, which yields 160 bits of security entropy and protects against brute force attacks.

Q: How does the Provisioning URI function?

The Provisioning URI packages the secret key, user email, organization name, and timer limits into a standard format that authenticators can read instantly.

Authentication Settings

Secret Key Length (Chars)

Refresh Period (Seconds)

Account Name (Email/User)

Issuer (App Name)

Generated Security Data

Base32 Secret Key

Security Entropy

0 Bits

Time Step

0 Sec

Provisioning URI

A Two Factor Authentication Safe Key Generator is a vital security utility used to create secure cryptographic keys. These keys act as the foundation for Time Based One Time Password authentication systems. Understanding how to generate robust secret keys helps developers and system administrators enhance the security of their applications.

How a 2FA Secret Key Works

The secret key is a random string of characters formatted in Base32. Both the server and the authenticator application share this exact same key. When a user needs to log in, both systems use the shared secret key and the current global time to calculate a matching numeric code.

Security Strength = Key Length * 5 Bits per Character

For example, if you generate a secret key that is 32 characters long using the Base32 alphabet, the mathematical strength or entropy of that key is exactly 160 bits. This level of security makes it mathematically impossible for attackers to guess the shared secret within a reasonable timeframe.

How to Use This Developer Tool

Enter your desired Secret Key Length. Modifying this length will instantly generate a completely new randomized key.
Set the Refresh Period, which determines how many seconds a generated code remains valid before expiring.
Input the Account Name to identify the specific user within the authenticator application.
Input the Issuer name so users can easily identify your application in their list of saved accounts.
Copy the Provisioning URI to construct setup QR codes for your users.

Frequently Asked Questions

Why is Base32 used instead of normal text?

Base32 encoding uses a restricted alphabet that intentionally excludes characters that look similar to each other, such as the number one and the lowercase letter L. This ensures that if a user ever needs to type the secret key manually into their phone, they will not make easily avoidable visual mistakes.

What is the recommended key length for security?

Industry standards highly recommend generating secret keys that provide at least 160 bits of entropy. This requires a Base32 string length of exactly 32 characters. Keys shorter than 16 characters are vulnerable, while keys longer than 64 characters provide excellent security but may be difficult to enter manually.

How does the Provisioning URI function?

The Provisioning URI is a universally accepted link format that combines all necessary setup details into one readable string. Authenticator applications scan this structured format to automatically configure the account name, issuer logo, secret key, and timer settings without requiring manual input from the user.