TOTP Generator
Turn a base32 secret into a live TOTP two-factor authentication code with a chosen 6 or 8 digit length and time period, entirely in your browser.
TOTP Generator — Paste a base32 secret and watch the matching TOTP two-factor authentication code update every second, exactly like Google Authenticator or Authy. Choose 6 or 8 digits and a 30-second (or custom) period, and generate a fresh random secret when you need one. Everything is computed locally with the Web Crypto API HMAC-SHA1, so your secret never leaves your browser.
What is TOTP Generator?
The TOTP Generator is a free online tool that turns a base32 shared secret into the same time-based one-time password (TOTP) that authenticator apps like Google Authenticator, Authy, or Microsoft Authenticator produce. Developers and QA engineers use it to test two-factor authentication flows, recover access when a key from an otpauth:// URI is on hand, or verify that a 2FA setup works without scanning a QR code. It implements RFC 6238 on top of RFC 4226 HOTP, computing an HMAC-SHA1 of the time counter and applying dynamic truncation to a 6- or 8-digit code that rolls over every period. The code and the seconds-remaining countdown refresh live each second, and a one-click button mints a fresh cryptographically random base32 secret for new test accounts.
How to use TOTP Generator
- Paste your base32 secret into the Secret field, or click Generate secret to mint a fresh random one. Spaces and hyphens are ignored.
- Pick 6 or 8 digits to match what your service expects.
- Set the Period in seconds (30 is the standard used by almost every authenticator app).
- Read the current code from the Code field; it updates on its own and the countdown shows how long it stays valid.
- Copy the code with the copy button before the countdown reaches zero, or wait for the next one to roll in.
Examples
Standard 6-digit, 30-second code (the common case)
Paste a secret such as JBSWY3DPEHPK3PXP, keep digits at 6 and period at 30. The Code field shows a six-digit number that changes every 30 seconds, identical to what Google Authenticator would display for the same secret at the same moment.
8-digit code for stricter setups
Switch digits to 8 for services that require a longer one-time password. The same secret now yields an eight-digit code, still rolling over on the chosen period.
Generating a fresh secret for a test account
Click Generate secret to create a new random 20-byte base32 key, then enter that same secret into the app or service you are setting up so both sides produce matching codes.
Frequently asked questions
- Is my secret uploaded anywhere?
- No. The base32 secret stays in your browser. The code is computed locally with the Web Crypto API (HMAC-SHA1), and nothing is sent to or stored on any server, so the tool works offline and your secret never leaves the page.
- Why doesn't my code match my authenticator app?
- TOTP depends on the current time and the exact secret, digit length, and period. Check that the digits (6 vs 8) and period (usually 30 seconds) match your service, that you pasted the full secret, and that your device clock is accurate, since a large clock skew shifts the code.
- What format does the secret need to be in?
- A base32 string using the letters A-Z and digits 2-7, the same encoding shown in an otpauth:// setup URI or under a QR code. Spaces, hyphens, lowercase letters, and trailing = padding are accepted; any other character is flagged as invalid.
- Which algorithm and standard does this use?
- It implements RFC 6238 TOTP over RFC 4226 HOTP using HMAC-SHA1, the default that virtually all authenticator apps use. SHA-256 or SHA-512 variants are not currently offered.
- Can I generate a secret here instead of pasting one?
- Yes. Generate secret creates a cryptographically random 20-byte key with crypto.getRandomValues and encodes it as base32, ready to register in the app you are protecting.
Related tools
AES Text Encryption (AES-GCM + PBKDF2)
Encrypt and decrypt text with AES-256-GCM using a passphrase-derived key (PBKDF2 SHA-256, random salt), entirely in your browser with no uploads.
HMAC Generator
Compute an HMAC signature from any message and a secret key using SHA-1, SHA-256, SHA-384 or SHA-512, with hexadecimal or Base64 output, live in your browser.
JWT Tools — Decode, Verify & Sign
Decode JWTs, verify HS, RS and ES signatures with a secret or PEM public key, and sign new HS tokens — all entirely in your browser.
Password Generator
Create strong, random passwords with adjustable length, lowercase, uppercase, digit and symbol sets, and ambiguous-character filtering, all in your browser.