TOTP Code Generator

What is a TOTP code?

A TOTP (Time-based One-Time Password) is the rotating 6- or 8-digit code used by two-factor authentication apps such as Google Authenticator, Microsoft Authenticator, 1Password, and Authy. It is defined by RFC 6238: the app takes your shared secret, combines it with the current time (usually in 30-second steps), and hashes the pair with HMAC-SHA-1, HMAC-SHA-256, or HMAC-SHA-512. Because both your device and the server perform the same calculation with the same secret and clock, they arrive at the same code without any network traffic.

Where to find your secret

The secret is not something you make up: the service you are enabling two-factor authentication for generates it and shows it to you.

• When enrolling: on the "Set up two-factor authentication" screen, most services show a QR code. The QR code encodes an otpauth://totp/Account?secret=XXXX&issuer=Service URI. If you cannot scan it, choose "Can't scan it?" / "Enter code manually" and the service displays the Base32 secret directly. That string, or the full URI, is the input for this tool.
• Exporting from an authenticator app: Aegis, 2FAS, and Bitwarden can export accounts as otpauth URIs. Paste one here to check its parameters before importing it elsewhere.
• Self-hosted and developer setups: Gitea, Nextcloud, and Vaultwarden show the secret in their two-factor settings. If you build 2FA support yourself, the server side generates both values:

  // Node with otplib
  import { authenticator } from 'otplib'
  const secret = authenticator.generateSecret() // Base32, ~160 bits
  const uri = authenticator.keyuri('user@example.com', 'MyApp', secret)
  

  # Python with pyotp
  import pyotp
  secret = pyotp.random_base32()
  uri = pyotp.totp.TOTP(secret).provisioning_uri(name='user@example.com', issuer_name='MyApp')
  

  
  Display that URI as a QR code for authenticator apps, and keep a copy of the plain secret so it can be verified with this tool before enrolment.

How to use this tool

1. Copy the Base32 secret your service showed you when setting up two-factor authentication, or paste a full otpauth://totp/... URI exported from an authenticator app.
2. The current code appears immediately and refreshes on its own every period, with a countdown to the next rotation.
3. Copy the code and enter it in the login form within its validity window.

If you paste an otpauth URI, the tool reads the secret, issuer, algorithm, digits, and period parameters and applies them automatically. Raw Base32 secrets use the defaults: SHA-1, 6 digits, 30 seconds, which is what most services use.

Understanding the options

• Digits: almost every service uses 6; a few (some enterprise SSO setups) issue 8-digit codes.
• Algorithm: SHA-1 is the de facto standard. SHA-256 and SHA-512 exist in RFC 6238 but are only used by services that say so explicitly.
• Period: 30 seconds is the default nearly everywhere. Some services use 60. A wrong period produces codes that never validate, so keep it at 30 unless your provider says otherwise.

If your generated code is rejected, the most common causes are a mistyped secret, the wrong algorithm, or a clock drift of more than one step on your device.

Privacy and security

The secret and the generated codes never leave your browser. This tool runs entirely client-side: there is no server, no upload, no logging, and nothing is written to the URL, local storage, or IndexedDB. Reloading the page forgets everything.

That said, treat a TOTP secret like a password. Only paste it into devices and tools you trust, and prefer the official app on your phone for accounts that matter.

Frequently asked questions

Does this replace my authenticator app?

For occasional logins on a machine you trust, yes. For daily use, a dedicated app is safer because it keeps the secret out of your browser session and can be locked behind biometrics.

When is this tool useful?

• Developing or testing 2FA: generate codes for a known secret while implementing server-side verification, without round-tripping through a phone.
• Verifying an enrolment before saving it: compute one code and log in successfully before you commit the QR code to your phone, so a bad secret never ends up in your authenticator.
• Logging in on a temporary device when your phone is unavailable but you kept a backup of the secret (which you should).
• Checking an otpauth URI exported from an authenticator app before importing it somewhere else.

Can I add my own account?

No. This tool only computes codes from a secret you already have. It cannot register new accounts with a service.

What about HOTP counter-based codes?

HOTP (RFC 4222) uses a counter instead of time and is rare in practice. This tool implements the time-based TOTP variant only.