Paste a 2FA secret key or an otpauth:// link to see the code your authenticator app would show now. It is computed on this device; the secret is never sent or saved.
How a TOTP code is made
A TOTP code (RFC 6238) is a one-time password computed from two things: the secret key a service gave you when you turned on two-factor authentication, and the current time. The time step changes every 30 seconds, and so does the code. The service computes the same code on its side and compares the two.
Your secret stays on this device
The code is computed with the Web Crypto API built into your browser. The page sends nothing: not the secret, not the code, not the account name. Nothing is stored and the secret is never put in the address bar, so a reload or a closed tab forgets it.
When to use it, and when not
It helps when your authenticator app is on a phone you do not have with you, or to check that a secret you wrote down is right. Anyone who holds a secret can make its codes, so keep it as private as a password, and for everyday use add it to an authenticator app on a device you trust.
Your account depends on a phone number too?
Many services tie sign-in and recovery to a phone number as well. Take a private number that is yours alone and is not given to anyone else while you keep it.
Where do I find my 2FA secret key?
When you turn on two-factor authentication, the service shows a QR code and, usually beside it, a setup key of letters and digits. That key is what goes here. If you did not keep it, the service cannot show it again: turn 2FA off and on to get a new one.
Why does the code not match the one the service expects?
Most often the device clock is off: TOTP depends on the time, so a clock a minute wrong gives a different code. Then check the settings: most services use 6 digits, SHA-1 and a new code every 30 seconds.
Is it safe to paste my secret here?
The page computes the code on your device and sends nothing anywhere; once it has loaded it works with the internet switched off. Still, the safest home for a secret is an authenticator app on a device you control, and a secret should never be pasted on a computer you do not trust.
Does it work with Google Authenticator or Microsoft Authenticator secrets?
Yes, for standard TOTP secrets in Base32, which is what those apps use. Codes in a service's own format, such as Steam Guard, are not supported.