🔑 Security

TOTP Code Generator (2FA)

Generate TOTP (Time-based One-Time Password) codes from a base32 secret, just like Google Authenticator. Useful for testing 2FA integrations without a phone.

TOTP secret (base32)

Digits

Period

Enter or generate a secret to see the TOTP code

⚠️ For development only. Do not use this tool with real TOTP secrets from production accounts. The secret lives only in the browser memory and is never sent to a server.

How it works

TOTP (RFC 6238) produces a numeric code that changes every 30s, derived from a shared secret and the current time. The algorithm runs HMAC-SHA1 over the number of the current time step. The secret is encoded in base32 (letters A–Z and digits 2–7). This tool uses the browser Web Crypto API — no data is sent to any server.

Test your 2FA flow without a phone

Anyone building two-factor login runs into the same chore: checking whether the code the server computes matches what the authenticator app shows. Switching between your computer and your phone slows you down, and sometimes the phone is not even nearby. Here you paste the base32 secret from your test environment and watch the 6 or 8 digit code refresh on screen with a countdown, exactly the way Google Authenticator renders it.

The code comes straight from RFC 6238: an HMAC-SHA1 of the secret applied to the current time-step number, which is Unix time divided by 30 or 60 seconds. No network involved, just secret plus clock. That is why, when a code refuses to match the server, the prime suspect is clock drift, not a wrong secret. The Generate button creates a random 160-bit secret already encoded in base32, the A to Z plus 2 to 7 alphabet that authenticator apps expect.

Stick to test and staging secrets. Avoid pasting the real 2FA secret for your bank or email, even though everything runs on the browser's Web Crypto API and nothing is sent to any server. If codes diverge, check that digits and period match the server configuration. One more detail: this tool computes HMAC-SHA1, the same default Google Authenticator uses; a service configured for SHA-256 TOTP will produce different codes.

Frequently asked questions

The code does not match my server. What should I check first?

Your computer clock: TOTP depends only on the secret and the time, so a few seconds of drift is enough to break it. Then verify digits, period, and whether the server expects SHA-1, which is what this tool uses.

Is it safe to paste my real account secret here?

The secret stays in the page's memory and is never uploaded, but good practice is to keep production 2FA secrets inside your authenticator only. Use this page for test and development secrets.

Where do I find the base32 secret?

It is the string of letters A to Z and digits 2 to 7 shown next to the QR code when you enable 2FA on a service. For testing, the Generate button creates a fresh 160-bit secret instantly.

Related Tools

🥁

Tap Code (Prison) Cipher

Convert text to pairs of taps (5×5 prison tap code) and back — visual representation included.

🔐

HMAC Generator

Generate HMACs (Hash-based Message Authentication Codes) with MD5, SHA-1, SHA-256, SHA-384, SHA-512 and SHA-3 algorithms.

🕵️

Source Code Secret Scanner

Finds API keys, tokens, passwords and private keys pasted from code or .env files, by known pattern and by high entropy.

🔑

Vernam Cipher (One-Time Pad)

XORs your text byte by byte against a key and prints the ciphertext in hex. A short key repeats, so it is a true one-time pad only if it matches the length.

🔄

TOTP vs HOTP Comparison

Compares TOTP and HOTP characteristics in a table and shows how each derives the one-time code.

🔑

TOTP otpauth URI Builder

Builds an otpauth://totp/ URI with issuer, account, base32 secret, digits and period for QR code apps.