TOTP Code Generator
Generate time-based one-time passwords from a Base32 secret or otpauth:// URI, with a live countdown and full RFC 6238 support.
Paste a Base32 secret and the 6-digit code appears immediately, refreshing every 30 seconds.
Current code
Valid for 30 s · next code ------
Everything runs locally. Your secret is signed in this tab with the Web Crypto API and never uploaded — but treat it as a permanent second factor, so avoid shared or untrusted computers.
How it works
A TOTP code is HOTP(secret, floor(unixTime / period)) as defined in RFC 6238 on
top of RFC 4226. The Base32 secret is decoded to raw bytes, the current 30-second counter is
written as an 8-byte big-endian integer, the two are combined with HMAC-SHA1, and the
standard dynamic-truncation step takes the low nibble of the last byte as an offset, reads
four bytes from there, masks the top bit and reduces the result modulo 10digits.
That is exactly what Google Authenticator, Authy, 1Password and your server-side verifier do,
so the code shown here matches theirs to the digit — this page reproduces every RFC 6238 test
vector, including the 8-digit 94287082 at T = 59.
Paste a raw Base32 secret (spaces and hyphens are ignored, case does not matter) or a whole
otpauth://totp/… URI — the URI's digits, period, algorithm, issuer and account are
read automatically. The code refreshes as the countdown bar empties and the next code is shown
alongside so you can tell whether a login failure is a wrong secret or a drifting clock. Tick
Compute the code at a specific time to pin the calculation to any Unix timestamp,
which is how you check a server against a known vector. All of it is plain JavaScript plus
crypto.subtle in your browser: no network requests, no accounts, no ads.
Your secret is read, decoded and signed inside this browser tab with the built-in Web Crypto API. It is never uploaded, logged or stored — reloading the page forgets it. Even so, a TOTP secret is a permanent second factor: prefer your authenticator app for day-to-day logins and use this page for setup, recovery and debugging, not on a shared or untrusted computer.
Frequently asked questions
How do I generate a TOTP code from a secret key?
Paste the Base32 secret your service showed you when you set up two-factor authentication — the string next to the QR code, usually 16 or 32 characters of A–Z and 2–7. Spaces, hyphens and lower case are all fine; they are stripped before decoding. The six-digit code appears immediately and refreshes as the countdown bar empties. If you have the whole otpauth:// URI instead of the bare secret, paste that: the digits, period, algorithm, issuer and account are read out of it and filled in for you. You can also paste a secret and let the tool build the otpauth:// URI to hand back to an authenticator app.
Why does my code not match the one my app or server expects?
Nine times out of ten it is the clock. TOTP is HMAC over floor(unixTime / 30), so if your device is more than a few seconds out of step with the server you land in the wrong 30-second window — the tool shows the next code alongside the current one so you can see whether the server is simply one step ahead. The other causes are non-default parameters: some services use 8 digits, a 60-second period or HMAC-SHA256 instead of the SHA-1 default, and a tool that hardcodes 6/30/SHA-1 will quietly produce the wrong number. Set Digits, Period and Algorithm to match. To rule the clock out entirely, tick 'Compute the code at a specific time' and enter the exact Unix timestamp the server used.
Is it safe to type my 2FA secret into this page?
The computation itself never leaves your device: the secret is decoded and signed with the browser's built-in Web Crypto API (crypto.subtle HMAC), there is no network request, no analytics on the value, nothing is stored, and reloading the page forgets it. That is different from TOTP sites that post your secret to a server, which you should avoid. The real caution is situational rather than technical — a TOTP secret is a permanent second factor, so it belongs in an authenticator app for everyday logins, and this page is best used for setup, recovery, testing your own implementation and debugging, on a computer you trust.