TOTP / 2FA Code Generator (RFC 6238)
Paste a TOTP secret (the base32 string a service shows when you set up 2FA), get the current 6-digit code with a countdown. Useful for quickly checking a code without opening your authenticator app, for development against 2FA-protected APIs, or for backup access when your phone is unavailable.
Security note
This tool runs entirely in your browser — your TOTP secret never touches the network. But you should still treat secrets carefully: anyone with the secret can generate the same codes. The authoritative place to store TOTP secrets is your authenticator app (with device biometrics) or a password manager.
How to use the TOTP / 2FA Code Generator (RFC 6238)
Paste the base32 secret. It's the string services show when you enroll in 2FA — also encoded inside the QR code as otpauth://...&secret=XXX&.... Most secrets are 6 digits / 30-second period / SHA-1 (defaults); a few services use SHA-256, SHA-512, or 8 digits — change the options to match.
What is the TOTP / 2FA Code Generator (RFC 6238)?
TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind Google Authenticator, Authy, 1Password's built-in TOTP, and most "Authenticator app" 2FA flows. The algorithm: take the shared secret, compute HMAC-SHA1 over the current time-step (current Unix time divided by 30), truncate to 6 digits. Both the user's device and the server compute the same value independently from the same secret + clock, so codes match without any network round trip.
This generator does the same calculation. Since browsers ship WebCrypto, all the math runs locally — your secret stays in your browser and the codes are computed against your system clock. Make sure your clock is accurate (within ±30 seconds) for the codes to match what the verifying server expects.
Common use cases
- Quick verification — confirm a code without unlocking your phone.
- API development — programmatically generate TOTP codes for testing against 2FA-protected endpoints.
- Emergency backup — when your authenticator device is unavailable but you saved the seed.
- Demonstrations — show how TOTP works without revealing real secrets.