TOTP Generator
Generate the rotating 2FA code for a secret key — the same time-based one-time password (TOTP) your authenticator app produces. Useful for testing 2FA setups or as a backup. Everything runs in your browser; your secret is never uploaded.
New to this? Read the TOTP guide →
Current code
Refreshes in 30s
Codes are generated locally with the Web Crypto API (RFC 6238). Your secret is never uploaded or stored. For everyday logins, a dedicated authenticator app is still recommended.
How to use the TOTP generator
- Paste the Base32 secret a site gave you when you set up two-factor authentication (the long key shown next to, or behind, the setup QR).
- The current 6-digit code appears with a live countdown to the next one.
- Optionally adjust the algorithm (SHA-1/256/512), digit count or period to match an unusual setup.
Codes are computed locally with the Web Crypto API, so your secret is never uploaded. For day-to-day logins a dedicated authenticator app is still the safer place to keep that secret; this tool is ideal for testing, backups and understanding how the codes are produced.
How the code is generated
TOTP is not sent to you. Your device and the server independently compute the same number from two things they both hold: the shared secret and the current time. They take the Unix time, divide it into 30-second steps, compute an HMAC of that step number keyed by the secret, and truncate the result to six digits. Because both sides share the secret and read the same clock, they land on the same code, which is why it works offline and rotates every 30 seconds.
Keep the secret safe
The security lives in the secret, not the rotating code: a stolen code is useless in 30 seconds, but anyone with your secret can generate valid codes forever. Treat it like a password, keep a backup so you are not locked out if you lose your phone, and remember TOTP defends a leaked password but not a real-time phishing page. For the full mechanics and how TOTP compares to SMS and passkeys, read how TOTP and authenticator apps work.
Frequently asked questions
What is a TOTP?
A TOTP (time-based one-time password) is the rotating 6-digit code used for two-factor authentication. It is computed from a shared secret and the current time (RFC 6238), so it changes every 30 seconds and matches what apps like Google Authenticator and Authy show.
Where do I find my secret key?
When you set up 2FA, the site shows a QR code and a “manual entry” or “setup key” — a string of Base32 letters and digits. Paste that here. You can also paste a full otpauth:// URI and the options fill in automatically.
Is it safe to paste my 2FA secret here?
The code is generated entirely in your browser and the secret is never uploaded or stored. Still, a TOTP secret is sensitive: only enter it on devices and sites you trust, and prefer a dedicated authenticator app for everyday use.
Where you'd use this
Testing a two-factor implementation, and recovering access when an authenticator app is unavailable but you still hold the secret.
For example: You are building 2FA sign-in and need to check that your server accepts codes from the standard algorithm. Pasting the same Base32 secret produces the code your app should expect, and shows whether a clock-skew tolerance is needed.