TOTP Code Generator
Generate time-based one-time passwords (2FA codes) from a base32 secret.
Runs in your browser Your input never leaves your device.
SHA-1, 6 digits and 30 seconds are the settings almost every authenticator app uses. Some apps (Google Authenticator among them) ignore other digit counts, periods and algorithms in an otpauth link, so test non-default settings with the app you need. The codes depend on your device clock being correct.
Report a problem with this tool
About this tool
Time-based one-time passwords (TOTP, RFC 6238) are the six-digit codes that authenticator apps show for two-factor login. Both sides share a secret key; every 30 seconds the app turns the key and the current time into a new code with HMAC (RFC 4226). This tool does the same calculation: enter a base32 secret, as shown when you set up two-factor authentication, and it displays the current code with a countdown, the next code, and an otpauth:// link you can reuse. Digits (6, 7 or 8), the period and the algorithm (SHA-1 by default, as most apps use, or SHA-256 and SHA-512) can be changed for services that differ, although some apps such as Google Authenticator ignore non-default settings. It is useful for testing your own two-factor implementation, for development and for checking why a code is rejected, which is often a wrong clock or a different period. The calculation uses the Web Crypto API and was checked against all the official test vectors of RFC 6238 and RFC 4226. A secret key gives full access to the second factor, so do not paste the real secret of an important account into any website; use test secrets, or press the button to make a random one. Nothing is sent anywhere.
How to use it
- Enter a base32 secret key, or press Make a random test secret.
- Compare the displayed code with your app or server.
- Change digits, period or algorithm if the service uses non-default settings.
- Make sure the clocks of both sides are correct.
Common problems
- My code is always rejected
- The most common cause is clock drift: make sure your device and server time are right. Also check the period (30 seconds is usual) and the algorithm.
- It says the secret key is invalid
- A base32 secret uses the letters A-Z and the digits 2-7. Spaces and dashes are ignored, and 0, 1, 8 and 9 are not allowed.
- Is it safe to use a real secret here?
- The page does not send anything, but a secret key is the master key to your second factor. Use test secrets on websites you do not control.