TOTP Code Generator
Turn a Base32 secret into a live 2FA code.
How to use
- 1 Paste your Base32 TOTP secret into the secret field.
- 2 If the service uses non-default settings, adjust digits, period or algorithm.
- 3 Read the live code and the countdown showing when it refreshes.
- 4 Copy the code and compare it with your authenticator app.
About TOTP Code Generator
The TOTP Code Generator turns a Base32 shared secret into the same six- to eight-digit one-time password your authenticator app would display.
Time-based one-time passwords (TOTP, defined in RFC 6238) combine a secret key with the current time so a fresh code appears every thirty seconds; this tool reproduces that calculation faithfully, including the HMAC and the dynamic-truncation step from the underlying HOTP standard.
It is genuinely useful when you are setting up or recovering an account: paste the secret a service shows you (the long string behind the QR code), and confirm the codes here match the ones in your phone before you trust the setup.
You can adjust the digit count, the time step and the hash algorithm — SHA1, SHA256 or SHA512 — to match whatever the service specifies, since not every provider sticks to the defaults.
Crucially, everything runs locally.
The HMAC is computed in pure JavaScript inside your browser tab, so your secret is never transmitted, logged or persisted, and the tool keeps working with no connection at all.
The displayed code and a small countdown refresh every second so you always see the value that is valid right now.
Treat your TOTP secret like a password: anyone holding it can generate your codes, so only paste secrets you control.
FAQ
Is my secret sent anywhere?
No. The code is computed entirely in your browser with a pure-JavaScript HMAC. The secret is never uploaded, logged or stored, and the tool works offline.
Why does my code differ from my phone?
Check the digits, period and algorithm match the service, and make sure your device clock is accurate — TOTP depends on the current time being correct.
What secret format does it expect?
The standard RFC 4648 Base32 secret (letters A–Z and digits 2–7). Spaces and dashes are ignored and casing does not matter.