TOTP Generator
Generate a live, auto-refreshing 6-digit TOTP code from a Base32 secret key.
How this tool works
Paste a Base32 secret
The same kind of secret encoded in a 2FA setup QR code.
A 6-digit code generates immediately
Computed using the real RFC 6238 TOTP algorithm via the Web Crypto API.
Watch it auto-refresh
A new code generates every 30 seconds, with a visible countdown to the next refresh.
Copy the current code
Grab the code while it's still valid to paste into a login form or test.
Quick facts
- Category
- Generators
- Best for
- Testing a 2FA integration during development without needing a phone in hand
About this tool
Paste a Base32-encoded TOTP secret - the same kind of secret an app like Google Authenticator or Authy scans from a QR code during 2FA setup - and get the current 6-digit time-based one-time password, refreshing automatically every 30 seconds with a visible countdown, exactly the way an authenticator app behaves. The code is generated using the real RFC 6238 TOTP algorithm (HMAC-SHA1 over a 30-second time counter, with RFC 4226 dynamic truncation to 6 digits) via the browser's native Web Crypto API, not a simplified approximation. The specific use case this is built for is development, not personal 2FA management: testing a 2FA integration during development, verifying a backend TOTP implementation matches the standard, or generating codes for automated test suites without needing a phone in hand. Runs entirely client-side - the secret you paste is never sent anywhere.
Why use this tool
Real RFC 6238 implementation
HMAC-SHA1 and dynamic truncation via the Web Crypto API, not a simplified stand-in.
Auto-refreshing with a countdown
Behaves like a real authenticator app, so you can see exactly how much time is left on a code.
Built for development, not daily 2FA
Meant for testing integrations and verifying implementations, not as a replacement for your actual authenticator app.
Secret never leaves your browser
The Base32 secret you paste is processed locally and never transmitted anywhere.
Frequently asked questions
Technically the computation happens entirely in your browser and the secret is never transmitted anywhere, but this tool is built for development and testing use - verifying a TOTP integration, checking a backend implementation matches the standard - not as a replacement for a dedicated authenticator app for your actual accounts. A dedicated authenticator app or password manager is the better choice for real account security.
It's the shared secret key a TOTP system uses to generate codes, encoded in Base32 (letters A-Z and digits 2-7) so it can be typed or embedded in a QR code safely. When you set up 2FA on a service, the "can't scan the QR code? enter this key manually" option shown during setup is this same Base32 secret - that's what belongs in this tool.
TOTP (RFC 6238) derives its code from the current Unix time divided into 30-second windows, which is the standard period essentially every authenticator app and 2FA-enabled service uses. Using the same time window on both the generating side and the verifying side is what allows two independent systems to compute matching codes without any live communication between them.
Explore more free tools
Formatters, converters, validators, and generators - all free and running entirely in your browser.
Browse more tools