TOTP / 2FA Code Generator
Time-based one-time passwords (TOTP) are the rotating six-digit codes that authenticator apps generate for two-factor authentication. This tool turns a TOTP secret — the Base32 string or QR-code key a service gives you when you enable 2FA — into the current code and shows the countdown until it refreshes. It is handy for testing a 2FA setup, keeping a backup when your phone is not nearby, or checking that a secret was stored correctly.
Codes are derived locally using HMAC and the Web Crypto API against your device clock, following the standard TOTP algorithm, so the values match what Google Authenticator, Authy, and similar apps produce. Your secret is never uploaded — it stays in the browser tab and is discarded when you close it. Because the secret is what protects your account, treat it like a password: only paste it into tools you trust, and prefer a dedicated authenticator app or hardware key for day-to-day use.
Generate time-based one-time passcodes (TOTP) from an authenticator secret — the same codes an app like Google Authenticator produces. Runs entirely in your browser.
Frequently asked questions
- What is a TOTP secret?
- It is the Base32 key a service shows (often as a QR code) when you turn on two-factor authentication. Combined with the current time, it generates the rotating codes.
- Is my secret sent anywhere?
- No. Codes are computed locally in your browser and the secret is never uploaded or stored. It is discarded when you close the tab.
- Why is my code being rejected?
- Usually a clock mismatch. TOTP depends on accurate time — make sure your device clock is correct and synced, since codes are only valid for a short window.
- Can this replace my authenticator app?
- It can generate valid codes, but for daily security keep secrets in a dedicated app or hardware key. Use this tool mainly for testing and backup.
- How long is each code valid?
- Typically 30 seconds. The countdown shows how long the current code lasts before the next one is generated.