TOTP / 2FA Code Generator

Generate a live six digit two factor code from a Base32 secret and watch it roll over every thirty seconds. The implementation follows RFC 6238, using HMAC with SHA-1 over a counter derived from the current time, which is the same calculation every authenticator app performs.

Base32 Secret

This is the same secret shown as text (or encoded in the QR code) when an app asks you to set up two-factor authentication.

How was this tool?

Your feedback helps us improve TOTP / 2FA Code Generator.

Why use TOTP / 2FA Code Generator?

A time based one time password is generated, not transmitted. Your device and the server both hold the same secret, both look at the clock, and both perform the same calculation. Because the code is derived rather than sent, there is nothing on the wire for an attacker to intercept during setup. The calculation is short. Unix time divided by thirty gives a counter that changes at the same instant everywhere. That counter is signed with HMAC-SHA1 using the shared secret, and six digits are pulled from the signature using a truncation rule fixed by the specification so that every implementation lands on the same digits. The one fragile assumption is the clock. Since both sides derive the counter from current time, a device whose clock has drifted will compute a different counter and produce a code the server rejects. When an authenticator app suddenly stops working, a wrong system time is nearly always the cause.

Key benefits

Follows the published standard, so codes match what an authenticator app produces
Live countdown, so you know whether to wait for the next window
Uses the browser's own Web Crypto implementation for the HMAC step
Reports an invalid Base32 character by name instead of failing silently
The secret never leaves the page, which matters more here than on any other tool

Features

RFC 6238 time based one time password with the standard thirty second period
HMAC-SHA1 over an eight byte counter, computed with crypto.subtle
Dynamic truncation to six digits, per the specification
Second by second countdown to the next rotation
Base32 decoding that accepts lowercase and strips padding

Popular use cases

Testing a two factor integration you are building without a phone in the loop
Recovering access when your authenticator app is unavailable but you kept the setup key
Verifying that a server side TOTP implementation produces matching codes
Demonstrating how time based codes work during training

How to use TOTP / 2FA Code Generator

1
Paste the Base32 secret
Use the setup key an app shows as text beneath its QR code. Spaces and lowercase are handled for you.
2
Read the code
A six digit code appears immediately and refreshes automatically at the end of each thirty second window.
3
Watch the countdown
The bar shows how many seconds the current code has left, so you can avoid submitting one about to expire.
4
Copy it
The copy button takes the current code without the spacing.

Frequently asked questions

How does TOTP actually work?

The current Unix time is divided by thirty to produce a counter. That counter is signed with HMAC-SHA1 using your secret as the key, and six digits are extracted from the result by dynamic truncation. Both sides run the same calculation, so no code ever travels over the network.

Why does the code change every thirty seconds?

Thirty seconds is the default period in the specification. A shorter window would leave too little time to type the code, and a longer one would widen the period during which an intercepted code stays usable.

Should I paste a real two factor secret here?

Everything runs in your browser and nothing is transmitted, so it is technically safe. Even so, a two factor secret is a long lived credential, and the safest habit is to keep it in a dedicated authenticator app and use this tool for testing or recovery rather than day to day.

My code does not match my authenticator app, why?

Almost always a clock difference. TOTP depends on both sides agreeing on the current time, so a device whose clock has drifted by more than a few seconds will produce a different code. Check that your system time is set automatically.

Why SHA-1 when it is considered broken?

The known SHA-1 weaknesses are collision attacks, which do not apply to how HMAC uses it. HMAC-SHA1 remains sound for this purpose, and the specification standardised on it, so every authenticator app uses it for interoperability.

Last reviewed: July 2026

How was this tool?

Related tools