diff --git a/.brew b/.brew
index 6f55148..c341424 100755
--- a/.brew
+++ b/.brew
@@ -23,6 +23,7 @@ brew install ffmpeg
 brew install fzf
 brew install rs/tap/jaggr
 brew install rs/tap/jplot
+brew install oath-toolkit
 brew install prettyping
 brew install ncdu
 brew install tmux
diff --git a/.encrypted/.otpkeys b/.encrypted/.otpkeys
new file mode 100644
index 0000000..d168114
Binary files /dev/null and b/.encrypted/.otpkeys differ
diff --git a/.functions b/.functions
index 956b047..cb06f56 100644
--- a/.functions
+++ b/.functions
@@ -279,6 +279,28 @@ function loc() {
   echo "${fg[white]}Total${reset_color} lines of code: ${fg[yellow]}$total${reset_color}"
 }
 
+# Returns 2FA code
+# Usage: otp <service name>
+function otp() {
+    if [ -z $1 ]; then
+        echo
+        echo "Usage:"
+        echo "   otp google"
+        echo
+        echo "Configuration: $HOME/.otpkeys"
+        echo "Format: name=key"
+        return 1;
+    fi
+
+    OTPKEY=$(sed -n "s/${1}=//p" ~/.otpkeys)
+    if [ -z $OTPKEY ]; then
+        echo "$(basename $0): Unknown service name '$1'"
+        return 1;
+    fi
+
+    oathtool --totp -b $OTPKEY
+}
+
 # Uploads a file to transfer.sh and returns the public URL
 # Usage: transfer <file>
 function transfer() {
diff --git a/Makefile b/Makefile
index b40da40..a804ef3 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,7 @@ install: ## Installs dotfiles into current environment
 
 install-encrypted: ## Installs encrypted dotfiles into current environment
 	@$(MAKE) DOTFILE=.ssh/config install_encrypted_file
+	@$(MAKE) DOTFILE=.otpkeys install_encrypted_file
 
 install_file:
 	@if [ ! -f ${HOME}/${DOTFILE} ]; then \