TOTP Generator
Generate authenticator (2FA) codes from a Base32 secret, live.
— — —
Refreshes in 30s · TOTP · SHA-1 · 30s · 6 digits
How TOTP / authenticator codes work
TOTP (Time-based One-Time Password, RFC 6238) is what apps like Google Authenticator and Authy use. It takes your shared Base32 secret, combines it with the current 30-second time step, and runs an HMAC-SHA1 to produce a 6-digit code that both sides can compute independently — no network needed. This tool does exactly that with the Web Crypto API, entirely in your browser, so the secret never leaves your device. Use it to test 2FA setups; for real accounts keep your secret private.
Related: the Base32 encoder, the HMAC generator, and the password generator.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Producing a code from a secret you hold when your authenticator app is on a device you cannot reach.
- Checking whether a mismatch is caused by clock drift rather than by the wrong secret.
- Verifying that a secret you are about to store really does generate the codes a service expects.
- Testing an enrolment flow end to end without a phone in the loop.
- Confirming that a QR code's embedded parameters match what your implementation assumes.
Frequently Asked Questions
- How does a TOTP code work?
- RFC 6238: take the Unix time divided by 30 to get a counter, run HMAC-SHA1 over it with your shared secret, then truncate the result to six digits. Both sides compute the same thing independently — nothing is transmitted, which is why it works offline.
- Why is it still SHA-1?
- Because HMAC-SHA1 is unaffected by the collision attacks that broke SHA-1 for signatures, and because every authenticator app implements it. The spec allows SHA-256 and SHA-512, but a server choosing one risks codes that a user's app cannot generate.
- What if my clock is wrong?
- Codes fail. The whole scheme depends on both sides agreeing on the time step, which is why servers usually accept the previous and next window as well — a ±30 second tolerance. A phone with a badly drifted clock is the most common cause of "invalid code".
- Is TOTP phishing-resistant?
- No, and this is its main weakness. A convincing fake login page can collect the code and replay it within its 30-second life, which is exactly how modern phishing kits work. Passkeys and hardware security keys bind to the origin and cannot be relayed this way.
- Is it safe to generate codes here?
- The computation is local and nothing is transmitted — but pasting a live TOTP secret into any web page means it has been in a browser's memory and possibly its history. Use it to test or recover a setup, not as your day-to-day authenticator.
Common errors and gotchas
- Treating the secret as less sensitive than a password. Anyone with it can generate codes indefinitely.
- Blaming the secret when the clock is wrong. Codes are time-derived, and a drifting clock breaks them silently.
- Assuming the period and digit count are fixed. Services vary, and the parameters travel in the enrolment URI.
- Expecting phishing resistance. A code can be relayed by an attacker in real time just like a password.
- Pasting a secret with spaces or the wrong case into an implementation that is stricter than the display format.
Related Cryptography & Security tools
Password Generator
Generate strong, random passwords locally.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes locally.
JWT Decoder
Decode JSON Web Tokens instantly and offline.
Bcrypt Generator
Generate and verify Bcrypt hashes with custom salt rounds.
MD5 Hash Generator
Generate an MD5 hash from any text.
SHA-1 Hash Generator
Generate a SHA-1 hash from any text.
SHA-256 Hash Generator
Generate a SHA-256 hash from any text.
SHA-512 Hash Generator
Generate a SHA-512 hash from any text.