TOTP Code Generator 🔒 Runs locally in your browser — nothing is uploaded.

Generate live 2FA authenticator codes from a Base32 TOTP secret.

Enter or generate a Base32 secret to see a live code.

otpauth:// URI

  
⚠ For testing and development only — e.g. verifying your own TOTP implementation against known secrets. Secrets you type here stay in this browser tab and are never uploaded anywhere. Do not paste a real production 2FA secret into any online tool, including this one, unless you fully trust it and understand the risk.
 
 
   
 
About this tool
 
TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind the six-digit codes shown by Google Authenticator, Microsoft Authenticator, Authy, and most "scan this QR code" two-factor setups. It works by combining a shared secret key with the current time, rounded down to a fixed window (usually 30 seconds), and running the result through HMAC — the same construction used by RFC 4226's HOTP, just with a time-derived counter instead of an incrementing one. Because both sides (your device and the server) know the secret and can read the clock, they independently compute the same code without ever transmitting it.
This tool runs the full RFC 6238 algorithm client-side using the browser's native WebCrypto HMAC implementation: paste (or generate) a Base32-encoded secret, and it derives the current code, live, refreshing every second and rolling over exactly when the 30-second window ends. It is meant for developers verifying a TOTP implementation, testing an onboarding flow, or understanding how authenticator codes are actually computed — not for storing your real accounts' 2FA secrets.
  
Frequently asked questions
 
 
Is this the same algorithm as Google Authenticator?
 
Yes — this implements RFC 6238 TOTP with SHA-1 (the default), which is exactly what Google Authenticator, Authy, Microsoft Authenticator and most 2FA apps use. Given the same secret, this tool and those apps will produce identical codes at the same moment.
 
 
Why did my code stop matching my authenticator app?
 
The two most common causes: your device's clock has drifted (TOTP is time-based, so both sides need accurate clocks — sync your system time), or you typed/pasted the Base32 secret slightly wrong. Double-check the secret character-by-character, since TOTP has no built-in way to detect a typo in the secret itself.