Lost access to your authenticator app but have the secret key? Enter it and get valid rotating 2FA codes. Everything is computed locally — the secret is not sent anywhere.
The code is computed locally in your browser (RFC 6238) and the secret never leaves the page. Still, prefer a dedicated authenticator for daily use.
TOTP depends on the clock: if your device time drifts by more than ~30 seconds, codes stop matching.
It's shown during 2FA setup as a Base32 string or inside the QR code — many services let you reveal it again in settings.