Step one is a normal web login. Step two is a real one-time code from Google Authenticator, verified right here in your browser with the same TOTP math (RFC 6238) production systems use. Nothing leaves the page and no accounts are real.
The first factor: something you know. Use the demo credentials below.
demo / demo1234The second factor: something you have. Open Google Authenticator (or any TOTP app: Authy, 1Password, Microsoft Authenticator), tap +, and scan this code.
Can't scan? In the app choose Enter a setup key and type:
Account demo, issuer IA 2FA Demo, time-based.
Type the 6-digit code Google Authenticator shows for IA 2FA Demo (demo).
This is the code your authenticator would show right now, computed from the same secret:
------Both factors checked out:
Even if the password leaked, an attacker without your phone stops at step 3. That's the whole point of 2FA.
Your browser blocked Web Crypto (this page needs HTTPS or localhost), so codes can't be verified here.