TOTP Generator
Enter a secret and generate TOTP two-factor codes right in your browser — compatible with Google Authenticator and other authenticator apps.
A TOTP code is the 6-digit two-factor code that changes every 30 seconds: the authenticator app and the server compute it independently from a shared secret and the current time (RFC 6238). Paste the Base32 secret from a 2FA setup screen — or the whole otpauth:// link — and this page shows the current code, the next code and a countdown ring, all computed in your browser: the secret is never sent, stored or logged. The guide how TOTP codes work explains the maths and the clock problem; pair it with the Password & Token Generator and the SSH Key Suite.
Last updated:
🔒 All calculations are done locally in your browser. Your secret is never sent to any server, and it is never stored.
Checking your clock against the server time…
Your codes
No accounts yet. Add a secret above and its code appears here, refreshing every period. Nothing is saved — reloading the page clears this list.
The honest limits
This page is a convenience for codes you already own — a phone charging in another room, or a secret you are migrating between authenticator apps. It is not a safe long-term home for secrets: what you paste lives in this tab's memory until you close it, on a machine other software can also read.
A code generator is only as trustworthy as the device and browser it runs in. For accounts that matter, keep the secret in a dedicated authenticator app or a hardware key on a device you control, use this page only on a device you trust, and never on a shared or public computer.
TOTP proves you hold the secret at login time; it does not protect a secret that has already leaked. If a secret was pasted into a chat, a ticket or a server-side generator, treat it as burned: turn 2FA off and on again at the service to mint a fresh secret.
When a browser TOTP generator is the right tool
The classic case is setup and migration. When you enable two-factor authentication, the service shows a QR code and, behind a “can't scan it?” link, the raw Base32 secret. Typing that secret here and comparing the code with the one your authenticator app produces proves both devices hold the same secret — before you log out and discover a mismatch the hard way. The same check works when moving accounts to a new phone: re-read each secret, add it here, and confirm the codes agree with the old app, window for window.
It is also the practical answer when the phone is not at hand but the secret is properly stored in your password manager: retrieve the secret, generate the code here, and sign in — without weakening the account by turning 2FA off. Services from Google and GitHub to AWS and your domain registrar all use the same RFC 6238 scheme, so one generator covers every account whose secret you hold.
What the QR code really contains
Every authenticator QR code is a single line of text: an otpauth:// URI carrying the secret, the issuer, your account name and the code parameters (algorithm, digits, period). That is why this page accepts the whole link — paste it and every field fills itself in. It is also why a screenshot of a setup QR code is as sensitive as the password itself: anyone who scans it owns a permanent copy of your second factor. Never share setup screenshots, and delete them from synced photo libraries.
Two details decide whether a code is accepted. The first is the clock: generator and server must agree on the current 30-second window, and most servers forgive only one window either side, so a clock that is a minute out fails every time. The second is the parameters: most services use SHA-1, 6 digits and 30 seconds, but some use 8 digits or a 60-second period — if the codes here never match the service, check the advanced settings against what its setup screen specified.
TOTP terms, pinned down
TOTP. Time-based One-Time Password (RFC 6238): an HMAC of the time-step counter, dynamically truncated to a short decimal code.
HOTP. The counter-based parent algorithm (RFC 4226). TOTP is HOTP whose counter is the number of periods since the Unix epoch.
Base32. The alphabet most 2FA secrets are written in (A–Z and 2–7). A 32-character secret carries 20 bytes — 160 bits — of key material.
otpauth://. The URI format inside every setup QR code: type, label, secret, issuer, algorithm, digits and period, all in one line.
Time step. Usually 30 seconds. Generator and server must land in the same step; most servers also accept the step before and after.
Dynamic truncation. The step that turns a 20+ byte HMAC into a short code: four bytes are cut starting at an offset given by the digest's last nibble.
SHA-1. Still the default HMAC hash for TOTP. The construction remains sound here because HMAC security does not rest on collision resistance.
Backup codes. One-time recovery codes a service issues at setup. They bypass TOTP entirely — store them like passwords, and never together with the secret.
Clock skew. The gap between a device clock and true time. A skew beyond one period makes every generated code wrong, however correct the secret is.
Frequently asked questions
Is it safe to generate 2FA codes in a browser?
On this page the secret never leaves your browser: codes are computed in page memory with WebCrypto, nothing is uploaded, stored or logged, and a refresh wipes the secret. The unsafe pattern is a server-side generator, where your secret crosses the network and sits in someone else's logs and databases. Even locally, use a device you trust — the secret is only as safe as the machine it is typed on.
Why is my code being rejected?
Most often the clock: if the device generating the code and the server disagree about the current 30-second window, every code is wrong. Check the clock card on this page and turn on automatic date & time. Next suspects are the parameters (a service using 8 digits or a 60-second period) and a stale secret — if you re-enabled 2FA, the old secret died at that moment.
What is the difference between TOTP and HOTP?
The counter. HOTP (RFC 4226) increments a counter with every use; TOTP (RFC 6238) derives the counter from the clock, so codes expire on their own. Authenticator apps and this page speak TOTP. Counter-based HOTP links exist, but this page declines them openly rather than inventing a code.
Can this replace my authenticator app?
While the page is open, it produces identical codes — the maths is the same. As a permanent home, no: nothing here persists, by design, and a browser tab is not where a long-lived secret belongs. Keep the secret in your authenticator app or password manager and use this page for setup checks, migrations and emergencies.
I pasted my secret into a chat once. What now?
Treat it as leaked. Chats are logged, synced and searchable, and anyone with the secret can generate your codes forever. Go to the service, turn two-factor authentication off and back on to mint a new secret, re-enrol your authenticator, and check the account's recent activity. Then check the password itself in the Password Breach Check.