TOTP Generator
Turn a base32 secret — or a full otpauth:// URI — into a live TOTP / 2FA code, exactly as an authenticator app would. Pick 6 or 8 digits, a 30 or 60-second step and SHA1 / SHA256 / SHA512, and watch the code roll over against a countdown, with the previous and next codes alongside. Built to verify or debug your own 2FA setup — RFC 6238-correct, 100% in your browser, nothing sent or stored.
Base32 uses the letters A–Z and digits 2–7. Spaces, hyphens and trailing = padding are ignored.
For test secrets or secrets you own only. A TOTP secret is a credential — anyone who has it can generate your codes. This runs entirely in your browser using the Web Crypto API: the secret is never sent to any server, never logged, and nothing is stored. Use it to verify or debug your own 2FA enrollment, not to hold real long-lived secrets.
What this tool is
- A free, in-browser TOTP / 2FA code generator: paste a base32 secret and it shows the current six- or eight-digit authenticator code with a live countdown to the next one.
- Paste a full otpauth:// URI (the thing behind a 2FA QR code) and it auto-fills the secret, digits, period and algorithm for you.
- Configure the parameters that real authenticator apps use: 6 or 8 digits, a 30 or 60-second time step, and HMAC-SHA1, SHA256 or SHA512.
- It also shows the previous and next codes, so you can confirm a server that accepts a one-step clock skew is behaving — and see exactly when the code rolls over.
- Everything runs client-side with the Web Crypto API. The secret you type is never sent anywhere and nothing is stored — made for verifying or debugging a setup you own.
What is a TOTP?
TOTP — a Time-based One-Time Password, specified in RFC 6238 — is the six-digit code your authenticator app shows for two-factor authentication. It is a special case of HOTP (HMAC-based One-Time Password, RFC 4226): instead of a counter that increments on each use, the counter is derived from the clock, so a fresh code appears on a fixed schedule without either side having to stay in sync beyond a shared secret and roughly agreeing on the time.
How a code is computed
- Shared secret. A random key is agreed once at enrollment, written in base32 (letters A–Z and digits 2–7) and usually delivered inside a QR code.
- Time counter. Both sides compute
T = floor(unixtime / period)(default period 30 s) and encode it as an 8-byte big-endian integer. - HMAC. Run
HMAC-SHA1(or SHA256/SHA512) over that counter with the secret as the key — 20 bytes out for SHA-1. - Dynamic truncation. The low 4 bits of the last HMAC byte pick a 4-byte offset; those 4 bytes (top bit masked off) become a 31-bit number, taken
mod 10^digitsand zero-padded to the final code.
The defaults, and the variations
Almost everything uses the RFC defaults: a 30-second period, 6 digits, and HMAC-SHA1. SHA-1 is deprecated for collision resistance but is perfectly sound here because TOTP uses it as a keyed MAC, not as a plain hash. Some systems lengthen the code to 8 digits, widen the step to 60 seconds, or require SHA256 / SHA512. A mismatch in any one of those four values makes every code wrong, which is why this tool lets you set all of them and why the otpauth:// URI carries them explicitly.
Clock skew and the previous/next codes
Clocks drift, so most servers accept a code from one step before or after the current window — a ±1-step tolerance. That is why this tool shows the previous and next codes next to the current one: if a user's code is being rejected, comparing against those tells you whether you are looking at a clock-skew problem rather than a wrong secret, digit count, period or algorithm.
Security note: a TOTP secret is a credential — whoever holds it can mint your codes indefinitely. Only ever paste a test secret or a secret you own and control, and treat this as a verify-your-own-setup tool, not an authenticator app for your real accounts. Everything runs entirely in your browser via the Web Crypto API; the secret is never transmitted, never logged and nothing is persisted. If you used this to debug a live enrollment, consider rotating the secret afterward.
Frequently asked questions
What is a TOTP, and how does an authenticator app work?
TOTP stands for Time-based One-Time Password, defined in RFC 6238. It is an HMAC-based one-time password (HOTP, RFC 4226) where the moving counter is simply the current time: the server and your authenticator app share a secret key once (usually by scanning a QR code), then each side independently computes floor(unixtime / step) as a counter, runs HMAC over it with the shared secret, and truncates the result to a short decimal code. Because both sides start from the same secret and the same clock, they derive the same code without ever exchanging it again — that is why an authenticator app works fully offline. The default step is 30 seconds, so the code changes twice a minute.
What do the digits, period and algorithm settings mean?
The secret is a shared key, usually written in base32 (A–Z and 2–7). The period (also called the time step) is how long each code is valid — 30 seconds is near-universal, though some systems use 60. The digits setting is the code length: six digits is standard, eight is sometimes used for higher entropy. The algorithm is the HMAC hash: almost every authenticator app and server uses HMAC-SHA1 (this is the default even though SHA-1 is otherwise deprecated, because TOTP uses it as a MAC, not for collision resistance), with SHA256 and SHA512 available for systems that require them. All four values come from the otpauth:// URI encoded in the enrollment QR code.
What is the otpauth:// URI format?
When you scan a 2FA QR code, it almost always contains an otpauth:// URI, for example otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30. The path after totp/ is a human label (issuer and account), and the query string carries the real parameters: secret (base32), optional issuer, algorithm, digits and period. Paste the whole URI into this tool and it will extract the secret and set the digits, period and algorithm for you, so you can reproduce exactly what your authenticator app would show.
Is it safe to enter my 2FA secret here?
A TOTP secret is as sensitive as a password: anyone who has it can generate your codes forever, so treat it with care. This tool is built to make that safe for the one legitimate use — verifying or debugging a setup you own. It runs entirely in your browser using the Web Crypto API; the secret is never transmitted to any server, never logged, and nothing is stored after you close the tab. That said, only ever paste a test secret or a secret you own and control. Never enter a secret that belongs to someone else, and if you are debugging a production enrollment, rotate the secret afterwards if you have any doubt about the device you used.
Why would a security or IT person use this?
It is a defensive, verify-your-own-setup tool. Common uses: confirming that a newly provisioned TOTP secret actually produces the codes your server expects before you hand it to a user; debugging a "my 2FA codes are rejected" ticket by checking whether the mismatch is a clock-skew problem (compare the previous/next codes), a wrong digit count, a non-default period, or a SHA256/SHA512 algorithm the client got wrong; validating that a backup or migration preserved the secret correctly; and teaching how TOTP works by watching the code change against the countdown. It is not a replacement for an authenticator app and should never hold your real long-lived secrets.