TOTP Generator
Generate time-based one-time passcodes (TOTP) from a Base32 secret key, the same codes used by authenticator apps — instantly inside your browser.
What is TOTP?
TOTP (Time-based One-Time Password) is the algorithm behind most two-factor authentication apps like Google Authenticator or Authy. It combines a shared secret key with the current time to generate a short numeric code that changes every 30 (or 60) seconds — both the app and the server compute the same code independently, without ever transmitting it, because they share the same secret and are checking the same time window.
This tool generates a live TOTP code from any Base32-encoded secret key, following the same RFC 6238 standard used by authenticator apps.
GuideHow to use it
How the code is generated
The current Unix time is divided by the period (30 seconds by default) to get a counter value, which is signed using HMAC-SHA1 with your secret key. A small slice of that signature is extracted and truncated down to a 6 or 8-digit number — this is exactly the algorithm defined in RFC 6238, so codes generated here match what a standard authenticator app would show for the same secret and moment in time.
Why it helpsFeatures & benefits
Why this runs entirely in your browser
A TOTP secret is as sensitive as a password, so codes are generated entirely locally using the Web Crypto API, and the secret key is never sent to a server.
Common uses
Testing a two-factor authentication integration during development, generating a code from a secret before it's scanned into an authenticator app, or verifying that a TOTP implementation produces the expected codes.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
It's usually shown as text (or embedded in a QR code) when you set up two-factor authentication on an account — most services offer a "can't scan the code" option that reveals the raw secret.
That's the standard TOTP time step — both your device and the server compute the code from the current time divided into 30-second windows, so they always agree as long as their clocks are in sync.
For day-to-day account security, use a dedicated authenticator app. This tool is best for testing, development, or understanding how TOTP works.
Check that the period and digit count match what the service expects (30 seconds and 6 digits is the near-universal default), and that your device's clock is accurate.
No. All code generation happens locally in your browser using the Web Crypto API. Nothing entered here is sent to a server, stored, or shared.