Generate TOTP Codes from Any Secret
Turn a Base32 2FA secret into live, RFC 6238-compliant one-time codes — computed entirely in your browser.
otpauth:// URI (optional)
Enter a valid secret to preview the otpauth:// URI.
Current Code
••• •••
About TOTP Code Generator
This tool generates Time-based One-Time Passwords (TOTP) as defined in RFC 6238, the same algorithm used by authenticator apps like Google Authenticator and Authy. Paste in a Base32-encoded secret — the kind you get when setting up two-factor authentication — and this tool computes the current, previous, and next codes using the Web Crypto API, entirely in your browser.
Features:
- RFC 6238-compliant TOTP with SHA-1, SHA-256, or SHA-512
- Configurable digit count (6 or 8) and time period (30s or 60s)
- Live countdown ring showing time until the next code
- 100% client-side — your secret never leaves your browser
How to Generate a TOTP Code
- Paste your Base32 secret into the input field
- Choose the digit count, period, and algorithm to match your setup
- Watch the current code update live with a countdown ring
- Copy the code, or optionally build an otpauth:// URI for reference
Frequently Asked Questions
What is a TOTP code?
A Time-based One-Time Password (TOTP) is a short numeric code that changes every 30 or 60 seconds, generated from a shared secret and the current time. It's the standard behind most authenticator apps used for two-factor authentication (2FA).
Is it safe to enter my real 2FA secret here?
Everything runs locally in your browser — the secret is never sent anywhere, and nothing is logged or stored. That said, entering any real, production 2FA secret into a web page carries some inherent risk (e.g. a compromised browser extension). For learning, testing, or a secret you control, this is safe; treat truly sensitive or shared-account secrets with extra caution.
What algorithms and settings does this tool support?
SHA-1 (the default used by nearly all authenticator apps), SHA-256, and SHA-512, with 6 or 8-digit codes and 30 or 60-second periods, matching the full range defined in RFC 6238.
Why doesn't my code match my authenticator app?
The most common causes are: your device's clock is out of sync (TOTP is time-sensitive), the algorithm, digit count, or period doesn't match what your account actually uses (most services use SHA-1, 6 digits, 30 seconds), or the secret was mistyped. Double-check each setting and your device's clock.
Does this tool store or transmit my secret?
No. The secret is decoded and used entirely in memory in your browser using the Web Crypto API. Nothing is sent to a server, logged, or saved after you leave the page.
What format should the secret be in?
A Base32-encoded string (letters A-Z and digits 2-7) — the same format shown when a service gives you a manual 2FA setup key instead of a QR code. Spaces, lowercase letters, and missing padding are all tolerated automatically.
Privacy
All computation happens locally in your browser using the Web Crypto API. Your secret is never uploaded, logged, or stored — but as with any web-based tool, avoid pasting truly sensitive production secrets unless you understand the risk.