Google 2FA setup
Google’s 2-Step Verification supports standard TOTP for everyone — but the setup key is hidden behind the QR code and Google nudges you toward its cloud-synced app. This guide gets you the plain Base32 key in under five minutes.
Fact-checked against Google's official documentation · last reviewed 9 November 2026 · how we review guides
Open the generator for GoogleStep by step
- 01
Open 2-Step Verification
Sign in at myaccount.google.com → Security & sign-in → "Turn on 2-Step Verification" (under "How you sign in to Google"). Confirm your password to proceed. If 2SV isn’t enabled yet, start it here.
- 02
Choose “Authenticator app”
Scroll to the available second-step options and add “Authenticator app”. Google shows a QR code — hold the page and the key below it.
- 03
Reveal the setup key
Click “Can’t scan it?” — a 32-character Base32 secret (e.g. JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP) replaces the QR. Copy it. This is the same secret the Google Authenticator app would store, minus the cloud-sync upload.
- 04
Generate codes locally
Paste the key into 2facounter.com. The live 6-digit code appears instantly and refreshes every 30 seconds. Your key never reaches our (nonexistent) servers.
- 05
Verify
Click Next in Google’s dialog, enter the current code, and confirm. Google adds “Authenticator” to your list of active second steps. Note: the up-to-7-day trust delay that Google documents applies to newly added 2SV phone numbers, not to authenticator methods.
- 06
Save backups where they belong
Store the Base32 key in your encrypted password-manager vault and print Google’s backup codes once (Security → 2-Step Verification → Backup codes). Recovery codes, not the app, are your airbag.
Google nuances worth knowing before you enroll
Personal vs. Workspace accounts
Everything in this guide is written for a personal Google account, where you control every second-step setting yourself. On a Google Workspace account, your admin can enforce security keys, hide the authenticator-app option, or block TOTP outright — if “Authenticator app” never appears in the second-step list, that’s a policy, not a bug. Ask your IT admin which methods are allowed before burning time in the settings.
The identical key, minus the cloud upload
The Base32 secret Google reveals is the same secret the Google Authenticator app would store. The only difference is what happens next: the app uploads secrets to Google’s servers so they survive a lost phone, while a plain TOTP key stays wherever you put it. If you’d rather accept the “I own my backups” responsibility — a key in your password manager, this site on any machine — the upload is exactly the thing you’re trading away.
Leave Google Prompt enabled as a fallback
Prompt (tap “Yes” on your phone) is Google’s fastest second step, but it dies when the phone does — battery, network, or loss. A TOTP code computed from a key you hold keeps working on any device. Enabling both costs nothing: keep Prompt for convenience, keep the browser generator as the phone-independent lane, and print backup codes for when even the browser is gone.
FAQ
Does this mean I avoid Google Authenticator’s cloud sync?
Exactly. Google switched its app to upload secrets to Google’s servers for “convenience”. With 2facounter.com, the secret stays on your machine only — no account, no backup you didn’t explicitly make, no cloud at any point.
Can my Google Workspace admin force a different method?
Yes — Workspace admins can enforce security keys or platform passkeys. That policy is intact regardless of authenticator; TOTP here only replaces which device computes the code.
Should I keep Google Prompt enabled too?
You can. Multiple second steps coexist: a phone prompt, TOTP codes, and backup codes are independent baskets. Prompt is convenient at your desk, but TOTP is the one that keeps working when the phone is dead — which is why a browser authenticator plus backup codes is the setup this site exists for.