TOTP Code Generator

TOTP Code Generator is a free, browser-based tool that turns a Base32 secret into the time-based one-time passwords (TOTP) used for two-factor authentication — the rotating 6-digit codes an authenticator app shows. Paste a secret, and it computes the current code, the next code, and a live countdown until the code refreshes, entirely on your device.

What is a TOTP code?

A TOTP (Time-based One-Time Password) is a short numeric code derived from a shared secret and the current time, defined in RFC 6238. Your app and the server both know the same secret, split time into fixed windows (usually 30 seconds), and run an HMAC over the window number. Because both sides use the same inputs, they independently arrive at the same code without ever exchanging it, which is what makes it a strong second factor.

How to generate a TOTP code

1. Paste your Base32 secret into the secret field, or click New secret to create a fresh random one.
2. Optionally set the issuer and account so the generated URI is labelled correctly.
3. Adjust digits (6 or 8), period (30 or 60 seconds), and algorithm (SHA-1, SHA-256, or SHA-512) to match your service.
4. Read the current code and watch the countdown ring; the next code is shown so you never get caught mid-refresh.
5. Copy the code, or copy the otpauth:// URI to load the same account into an authenticator app.

Why use a client-side TOTP generator?

Because the secret behind your 2FA is as sensitive as a password, and it should never touch a server you do not control. Everything here runs locally with the Web Crypto API, so your secret stays in the tab and is never uploaded or logged. That makes it useful for testing an integration, recovering access when your phone is unavailable, or verifying that a service's setup secret produces the codes you expect. If you need a secret worth protecting in the first place, you can create a high-entropy string with the Strong Password Generator and then Base32-encode it for use here.

• Standards-compliant: implements RFC 6238 TOTP with RFC 4226 dynamic truncation.
• Live countdown: a ring shows exactly how many seconds remain before the code rotates.
• Current and next code: see the upcoming code so a refresh never trips you up.
• Configurable: choose 6 or 8 digits, a 30- or 60-second period, and SHA-1/256/512.
• Portable output: a ready-made otpauth:// URI for importing into apps.
• Zero dependencies: only the native crypto.subtle HMAC is used.

What is the Base32 secret and otpauth URI?

The secret is the shared key that both your app and the server hold. It is stored in Base32 because that alphabet (A–Z and 2–7) is case-insensitive and easy to type or embed in a QR code. If you want to inspect or convert a secret's raw bytes, the Base32 Encoder & Decoder shows exactly how the encoding maps to bytes. The otpauth:// URI packs the secret together with the issuer, account, digits, period, and algorithm into a single string; feed that string into the QR Code Generator to produce the scannable square that most authenticator apps expect during setup.

TOTP versus raw HMAC: how they relate

TOTP is really a thin layer on top of HMAC. The generator runs an HMAC over the current time counter and then truncates the result down to a few digits. If you want to see the underlying keyed hash for any message rather than a time-derived code, the HMAC Generator exposes that step directly. TOTP simply fixes the message to a time window and formats the output as a short number. When your goal is confidentiality rather than authentication — hiding a message instead of proving who sent it — reach instead for reversible encryption such as AES Text Encryption.

Frequently Asked Questions

Does my secret get sent anywhere?

No. The Base32 secret and every code are computed entirely in your browser with the Web Crypto API. Nothing is uploaded, logged, or stored on any server, and closing the tab discards everything.

Why is my code different from my authenticator app?

Almost always a settings or clock mismatch. Confirm the digits, period, and algorithm match your service (most use 6 digits, 30 seconds, SHA-1), that the secret is entered exactly, and that your device clock is accurate, since TOTP depends on the current time.

What algorithm and parameters does it use?

It follows RFC 6238: an HMAC (SHA-1, SHA-256, or SHA-512) over an 8-byte big-endian time counter, then RFC 4226 dynamic truncation to 6 or 8 digits. The default of 6 digits, 30 seconds, and SHA-1 matches Google Authenticator and most services.

Can I create a brand-new secret here?

Yes. Click New secret to generate a cryptographically random 160-bit key, encoded as Base32. You can then copy it or the otpauth URI into an authenticator app and the matching service.

Is it safe to generate my 2FA codes in a browser?

For testing, recovery, or verification it is convenient and private, because nothing leaves your device. For everyday production 2FA, a dedicated authenticator app or hardware key on a separate device is still the recommended practice, so a stolen laptop does not expose both factors at once.

What is the countdown ring showing?

It shows the seconds left in the current time window before the code rotates. When it reaches zero, the current code becomes invalid and the next code shown takes over, matching the same rotation your service performs.