Runs in your browser. Your files and text never leave your device - nothing is uploaded.
Generate 2FA Codes from a Secret Key
The Tools Kit’s free TOTP / 2FA Code Generator turns a Base32 two-factor authentication secret into the same six-digit, 30-second code an authenticator app would show. Paste the setup key a service gave you and a live code appears at once, with a countdown to the next one and a button to copy it.
The code is computed in your browser with the built-in Web Crypto API, following RFC 6238 (HMAC-SHA1, 30-second time step, six digits). Your secret is not sent to a server or saved anywhere. It is built for developers testing a 2FA login, for checking that a server-side implementation produces matching codes, and for anyone who kept a setup key and needs a code while their phone is out of reach.
How to Use the TOTP Generator
- 1
Find the setup key
When a site turns on two-factor authentication it shows a QR code and, usually beneath it, a text secret labelled something like "setup key" or "can't scan the code?". Copy that Base32 text; it uses only the letters A-Z and the digits 2-7.
- 2
Paste it into Base32 Secret
Paste the key into the Base32 Secret field. Lowercase letters, spaces between groups and trailing = padding are all accepted, so you can paste it exactly as the site displays it.
- 3
Read the live code
A six-digit code appears straight away. It is recalculated every second and rolls over to a new code at the end of each 30-second window, with a bar and a "Refreshes in" counter showing the time left.
- 4
Copy and enter it
Click Copy and paste the code into the verification box. If only a few seconds are left on the countdown, wait for the next code so it does not expire before the server checks it.
The tool takes the raw Base32 key only. It does not read QR codes or parse otpauth:// links; if you have such a link, paste just the value after secret=.
How TOTP Codes Are Calculated
A time-based one-time password is never sent to you; your authenticator and the server each work it out independently from the same shared secret and the same clock. The generator on this page follows the four steps of RFC 6238:
- Decode the secret. The Base32 text is turned back into raw bytes. Each character carries 5 bits, so the 16-character sample key JBSWY3DPEHPK3PXP becomes 10 bytes. You can produce your own test secrets by encoding text with the Base32 encoder.
- Build the counter. The current Unix time in seconds is divided by 30 and rounded down, then written as an 8-byte big-endian number. Every device in the world gets the same counter during the same 30-second window. The timestamp converter shows the Unix time for any date if you want to work out a counter by hand.
- Sign it with HMAC-SHA1. The counter is the message and the secret is the key, giving a 20-byte signature. This is the same keyed-hash construction you can experiment with in the HMAC generator.
- Truncate to six digits. The low 4 bits of the last byte give an offset from 0 to 15. Four bytes starting there are read as a 31-bit number, which is reduced modulo 1,000,000 and padded with leading zeros.
Worked Example with the RFC 6238 Test Secret
The RFC publishes test vectors using the ASCII secret 12345678901234567890, which in Base32 is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ. At Unix time 59 seconds:
| Step | Result |
|---|---|
| Counter | floor(59 / 30) = 1 |
| HMAC-SHA1 (hex) | 75a48a19d4cbe100644e8ac1397eea747a2d33ab |
| Offset | Last byte 0xab, low 4 bits = 11 |
| 31-bit value | 1,094,287,082 |
| Six-digit code | 1,094,287,082 mod 1,000,000 = 287082 |
The RFC lists the eight-digit result 94287082; the last six digits match. At Unix time 1111111109 the counter is 37037036 and the six-digit code is 081804, which shows why leading zeros are kept. The tool always uses your current clock, so it will show today’s code for that secret rather than these historical ones, but the calculation is identical.
Keeping Your 2FA Secret Safe
Anyone who holds the setup key can generate valid codes forever, so treat it like a password. Store backup copies of 2FA secrets in an encrypted password manager rather than in notes or screenshots, and never reuse the account password that the second factor protects. A fresh one from the password generator is a good start, and the password strength checker estimates how well an existing one holds up.
Developers building their own 2FA should generate secrets with a cryptographically secure random source (RFC 4226 requires at least 128 bits and recommends 160 bits, matching the SHA-1 output size), store them encrypted, and accept at most one window of clock drift either side. After the TOTP check succeeds, many apps issue a session token; the JWT decoder helps confirm what that token contains.
Common uses
- Testing a two-factor login you are building without reaching for a phone
- Checking that a server-side TOTP library produces the same codes as an authenticator app
- Generating a code from a saved setup key when your authenticator device is unavailable
- Confirming a copied 2FA secret is valid Base32 before saving it to a password manager
- Demonstrating how time-based one-time passwords work in a training session
For hashing, encoding and token utilities, browse all security tools.
TOTP and 2FA terms explained
| Term | What it means |
|---|---|
| TOTP | Time-based One-Time Password (RFC 6238): a short code derived from a shared secret and the current time |
| HOTP | HMAC-based One-Time Password (RFC 4226): the counter-based algorithm TOTP is built on; TOTP simply uses time as the counter |
| Shared secret | The random key the service and your authenticator both store; shown as Base32 text or inside the setup QR code |
| Base32 | An encoding that uses A-Z and 2-7 (RFC 4648), chosen for 2FA keys because it avoids confusable characters such as 0, 1 and 8 |
| Time step | The length of each code window; fixed at 30 seconds in this tool, the standard default |
| Dynamic truncation | The RFC 4226 step that picks four bytes from the HMAC output and reduces them to a fixed number of digits |
| otpauth:// URI | The text a 2FA QR code contains, carrying the secret plus the issuer, account name and optional algorithm, digits and period |
Frequently Asked Questions
Paste the Base32 secret into the Base32 Secret field. The tool decodes it, divides the current Unix time by 30 to get a counter, signs that counter with HMAC-SHA1 using the secret as the key, and truncates the result to six digits. The code appears instantly and refreshes every 30 seconds.
The calculation runs entirely in your browser with the Web Crypto API; the secret is not sent to a server or saved, and it is gone when you close the page. Even so, a 2FA secret is a long-lived credential, so the safest habit is to keep it in a dedicated authenticator app and use this page for testing, verification or one-off recovery.
The most common cause is a clock difference: TOTP depends on both sides agreeing on the time, and this tool uses your device clock. Check that the clock is set automatically. Other causes are a mistyped secret, or a service that uses non-standard settings such as SHA-256, eight digits or a 60-second period, which this tool does not support.
It uses the RFC 6238 defaults that almost every service and authenticator app use: HMAC-SHA1, a 30-second time step and six-digit codes. These settings are fixed; there is no option to switch to SHA-256 or SHA-512, eight digits or a different period.
No. The tool accepts only the Base32 secret itself. If you have an otpauth:// URI, copy the value after secret= (up to the next &) and paste just that. Most sites also show the secret as text next to the QR code if you choose the option to enter the key manually.
Base32 secrets use only the letters A to Z and the digits 2 to 7. The error names the first character outside that set, often a 0, 1, 8, 9 or a hyphen copied by mistake. Spaces, lowercase letters and trailing = padding are accepted and do not cause the error.
Each code belongs to one 30-second window aligned to the Unix clock, so a new code starts at :00 and :30 past every minute. Many servers also accept the previous or next code to allow for small clock drift, but that tolerance is set by the server, not by the code.
It runs the same standard algorithm those apps use for six-digit, 30-second codes, so for the same secret and the same time it produces the same code. Unlike those apps, it does not store any accounts; you paste the secret each time you open the page.
The known SHA-1 weaknesses are collision attacks, which do not threaten HMAC-SHA1 as used in TOTP. RFC 6238 allows SHA-256 and SHA-512, but SHA-1 remains the default that nearly every authenticator app expects, which is why services keep using it for compatibility.
HOTP (RFC 4226) generates a code from a counter that increases each time a code is used. TOTP (RFC 6238) uses the same HMAC and truncation steps but derives the counter from the current time divided by the time step, so codes expire on their own instead of waiting to be used.
Only if you saved the original setup key. With the Base32 secret you can produce valid codes here, but the tool cannot recover a secret you no longer have. Without it, use the backup or recovery codes the service gave you, or its account recovery process.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
How do you generate a TOTP code from a secret key?
To generate a TOTP code, paste the Base32 secret shown when setting up two-factor authentication, such as JBSWY3DPEHPK3PXP. A six-digit code is produced using HMAC-SHA1 over a 30-second time step, the same algorithm Google Authenticator and Authy use, and refreshes with a live countdown. The secret never leaves the browser.
Why is my TOTP code not working?
A TOTP code depends on the current time, so a device clock that is off by more than about 30 seconds produces the wrong code; check that the clock is set automatically. Also confirm the secret was pasted exactly, ignoring spaces and case, and that the service uses the standard six-digit, 30-second, SHA-1 settings.