TOTP Code Generator
Generate time-based one-time passwords from a Base32 secret, and check what your authenticator app should be showing.
Current code
------
Expires in 30s
Use this for testing, not as your authenticator:
- Everything runs locally and nothing is transmitted, but a secret pasted into a browser tab is not stored securely
- Use it to verify a server implementation, debug clock skew, or check an enrolment — not to hold your real 2FA secrets
- TOTP depends on the clock: if codes are rejected, check your system time before suspecting the secret
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The TOTP Generator produces the same six-digit codes an authenticator app shows, from a Base32 secret you supply. It implements RFC 6238 on top of RFC 4226 — the secret is combined with the current time window, hashed with HMAC, and reduced to a short code by dynamic truncation. A live countdown shows exactly when the current code rolls over.
It is built for verifying a 2FA implementation rather than replacing your authenticator: enrol the generated QR code, confirm your app shows the same digits, and you have proven the server and client agree on secret, algorithm, digit count, and period. When codes are rejected despite matching secrets, the cause is almost always clock skew, since TOTP derives everything from the current time. Generation uses the browser's Web Crypto API and your secret never leaves the page — though a secret pasted into a browser tab is not stored securely, so keep real 2FA secrets in a proper authenticator.
FAQ
TOTP is the algorithm behind authenticator apps. It hashes a shared secret together with the current 30-second time window, so both sides derive the same short code without ever exchanging it.
Usually clock skew. TOTP derives the code from the current time, so if your device clock is off by more than the server's tolerance window the codes will not match. Check the system clock before suspecting the secret.
Base32, which is what authenticator apps and otpauth:// URIs use. Lowercase letters, spaces, and trailing padding are all tolerated — the characters 0, 1, and 8 are not part of the Base32 alphabet.
No — treat it as a testing tool. It runs entirely offline and transmits nothing, but a secret pasted into a browser tab is not stored securely. Use it to verify a server implementation, debug clock skew, or check an enrolment.
SHA-1 with 6 digits over a 30-second period is the near-universal default, and what most authenticator apps assume. Change these only if the service you are integrating with explicitly specifies otherwise.
It encodes a standard otpauth:// URI, so scanning it enrols the same secret in an authenticator app. You can then confirm the app's code matches the one shown here.