TOTP Generator (2FA Codes)
Generate time-based one-time passwords (TOTP) from a Base32 secret with SHA-1/256/512, 6–8 digits and any period. Live countdown, RFC 6238 verified.
The key shown by the service when you set up 2FA. Spaces and lowercase are fine.
Leave empty to use the current time.
TOTP (RFC 6238) computes HOTP with the counter T = floor(Unix time / period). Most apps use SHA-1, 6 digits and 30 seconds. Your device clock must be accurate. The secret never leaves your browser, but treat it like a password.
Runs entirely in your browser. Your data is never uploaded.
What is TOTP Generator (2FA)?
This tool computes the same 6–8 digit codes that authenticator apps show, from a Base32 secret key. It refreshes live with a countdown, also shows the previous and next codes, and can compute the code for any Unix time to test servers.
How to use TOTP Generator (2FA)
- Paste the Secret key (Base32) or click New random secret.
- Set Algorithm, Digits and Period to match the service (usually SHA-1, 6, 30).
- Read the current code and the seconds remaining.
- Optionally enter a Unix time to compute the code for a specific moment.
Example
Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, SHA-1, 8 digits, Unix time 59
94287082
RFC 6238 Appendix B test vector (secret is ASCII 12345678901234567890 in Base32).
When to use TOTP Generator (2FA)
Use it to test a 2FA implementation, recover codes on a desktop when you have the secret, or understand how TOTP works. Do not keep your real account secrets in browser tabs; use an authenticator app or password manager.
How TOTP Generator (2FA) works
TOTP (RFC 6238) computes HOTP (RFC 4226) with the counter T = floor(Unix time / period): HMAC-SHA-1/256/512 of the 8-byte big-endian counter keyed with the Base32-decoded secret, then dynamic truncation (offset = last nibble) and modulo 10^digits. HMAC is computed with the Web Crypto API. All RFC 6238 Appendix B test vectors are reproduced exactly.
Common Use Cases
- Testing TOTP login in a web application under development
- Checking server clock drift by comparing codes
- Reproducing RFC 6238 test vectors
- Generating codes for a test account in CI documentation
Security Note
A TOTP secret is as sensitive as a password: anyone who has it can generate your codes.
FAQs
Why do my codes not match the app?
Check that algorithm, digits and period match, and that your computer's clock is accurate; a 30-second clock difference changes the code.
Is my secret sent anywhere?
No. The HMAC is computed in your browser with Web Crypto.
What Base32 alphabet is used?
RFC 4648: A–Z and 2–7. Spaces, dashes, lowercase and = padding are accepted and ignored.