TOTP Generator
Paste the Base32 secret from a 2FA setup screen to see the current six-digit code and the next one, with a countdown. Nothing is stored or sent.
Enter a secret to generate codes.
About this tool
Two-factor apps implement RFC 6238: an HMAC of the current 30-second time step, computed with a shared secret, truncated to six digits. Given the same secret and a correct clock, this page produces exactly the code your authenticator app shows. That makes it handy for testing a login flow you are building, for recovering access when a phone is unavailable but the secret was saved, or simply to understand how the mechanism works.
The tool supports 6–8 digits, custom periods and SHA-1, SHA-256 and SHA-512, and builds the otpauth:// URI that authenticator apps import (paste it into the QR Code Generator to scan it). Treat secrets like passwords: anyone with the secret can generate your codes.
Frequently asked questions
- The code does not match my app. Why?
- Check the clock on your device, the digit count and the algorithm. Most services use SHA-1, 6 digits and 30 seconds.
- Is it safe to paste my secret here?
- The secret is only used in your browser and is never transmitted. Still, avoid doing it on a shared computer.
- Can I generate a secret for my own service?
- Yes. Press Random secret to get 160 bits of Base32, then share it via the otpauth URI or QR code.