Loading...
Turn a Base32 2FA secret into live, RFC 6238-compliant one-time codes — computed entirely in your browser.
Only paste a real 2FA secret on a device you trust: anyone who sees it can generate your codes. The example button loads the public RFC 6238 test key.
Enter a valid secret to preview the otpauth:// URI.
••• •••
This tool generates Time-based One-Time Passwords (TOTP) as defined in RFC 6238, the same algorithm used by authenticator apps like Google Authenticator and Authy. Paste in a Base32-encoded secret — the kind you get when setting up two-factor authentication — and this tool computes the current, previous, and next codes using the Web Crypto API, entirely in your browser.
What is a TOTP code?
A Time-based One-Time Password (TOTP) is a short numeric code that changes every 30 or 60 seconds, generated from a shared secret and the current time. It's the standard behind most authenticator apps used for two-factor authentication (2FA).
Is it safe to enter my real 2FA secret here?
Everything runs locally in your browser — the secret is never sent anywhere, and nothing is logged or stored. That said, entering any real, production 2FA secret into a web page carries some inherent risk (e.g. a compromised browser extension). For learning, testing, or a secret you control, this is safe; treat truly sensitive or shared-account secrets with extra caution.
What algorithms and settings does this tool support?
SHA-1 (the default used by nearly all authenticator apps), SHA-256, and SHA-512, with 6 or 8-digit codes and 30 or 60-second periods, matching the full range defined in RFC 6238.
Why doesn't my code match my authenticator app?
The most common causes are: your device's clock is out of sync (TOTP is time-sensitive), the algorithm, digit count, or period doesn't match what your account actually uses (most services use SHA-1, 6 digits, 30 seconds), or the secret was mistyped. Double-check each setting and your device's clock.
Can I use this page as my everyday authenticator?
It’s not a good fit. The page deliberately never saves your secret, so you would have to paste it every time, and each paste is another chance for it to leak. Use an authenticator app for daily sign-ins; this tool is for testing, debugging and checking codes when you already have the secret at hand.
What format should the secret be in?
A Base32-encoded string (letters A-Z and digits 2-7) — the same format shown when a service gives you a manual 2FA setup key instead of a QR code. Spaces, lowercase letters, and missing padding are all tolerated automatically.
All computation happens locally in your browser using the Web Crypto API. Your secret is never uploaded, logged, or stored — but as with any web-based tool, avoid pasting truly sensitive production secrets unless you understand the risk.