About the TOTP Generator
TOTP Generator works out the current two-factor authentication code from a secret key, the same code that an authenticator app such as Google Authenticator, Authy or Microsoft Authenticator shows. Paste the base32 secret (or the whole otpauth:// link), choose the number of digits, the period and the algorithm if they differ from the usual 6 digits, 30 seconds and SHA-1, and the page shows the code and a countdown to the next one. It follows RFC 6238 and runs in your browser, so the secret never leaves your device. It is handy for testing, for development and for recovering a code from a backup key.
Updated October 2026
How to use the TOTP Generator
- 1Paste the secret key, or the otpauth link, into the box.
- 2Leave the settings at 6 digits, 30 seconds and SHA-1 unless the service says otherwise.
- 3Read the current code and the countdown.
- 4Copy the code and type it into the website.
- 5Wait for the next code when the bar runs out.
How the code is made
The device takes the number of 30 second steps since 1 January 1970, signs it with the secret using HMAC, and turns part of the result into a short decimal number. Because both sides share the secret and the clock, they get the same code. Nothing is sent when you read the code, which is why it works offline.
Using it for testing
Developers use a TOTP generator to test a login flow, to check that a server accepts codes in a time window and to compare their code with a known library. It follows the examples in RFC 6238, so the output can be checked against the published test values.
- Secret ending in padding = is fine; spaces and dashes are ignored
- Check clock drift if codes are rejected
- Compare digits, period and algorithm with the service's settings
Protecting your secrets
Anyone with the secret key can make your codes, so store it as carefully as a password, preferably in a password manager that supports TOTP. Do not share screenshots of QR codes. If a secret is exposed, turn off two-factor authentication and set it up again.
Related tools
Make strong passwords with the Password Generator and test them with the Password Strength Checker. The HMAC Generator and the Hash Generator show the building blocks, and the JWT Decoder helps with tokens.
Features
- Standard RFC 6238 time-based codes
- 6, 7 or 8 digits
- 15, 30 or 60 second periods
- SHA-1, SHA-256 and SHA-512
- Accepts otpauth:// links
- Private: nothing is uploaded
Frequently asked questions
What is TOTP?
Time-based one-time password. Your device and the website share a secret key; both work out a short code from the key and the current time, and the codes change every 30 seconds.
Where do I find the secret key?
When you turn on two-factor authentication, most sites show a QR code and, under it, a text key to use if you can't scan. Save that key somewhere safe.
Is it safe to paste my secret here?
The code is worked out in your browser and the secret is never sent. Even so, treat the key like a password: use this page for testing or with a computer you trust, not on a shared one.
Why is my code wrong?
Check that your computer's clock is correct to within a few seconds, that the secret has no typing mistakes and that the digits, period and algorithm match the service.
What does the otpauth link contain?
The secret, the account name and the issuer, in a link that QR codes use. The tool reads the secret from it.
Can this replace my authenticator app?
For daily use an app on your phone is more convenient and keeps the secret out of the browser. This tool is for testing, development and recovery.
Which algorithm do most sites use?
SHA-1 with 6 digits and 30 seconds. Some services use SHA-256 or SHA-512, and some use 8 digits.
Is anything stored?
No. The secret is kept only in the page while it is open.