2FA / TOTP Code Generator

What is a TOTP / 2FA code?

A TOTP (Time-based One-Time Password) is a short numeric code that changes every 30 seconds and is used as the second factor in two-factor authentication. Both the server and your authenticator app share a secret key and combine it with the current time to derive the same code — no internet connection required.

This tool reproduces that calculation in the browser. Paste the Base32 secret you were given during 2FA setup (the text shown under the QR code) and it generates the current 6-digit code along with a live countdown to the next one.

How it works

• Implements RFC 6238 TOTP with HMAC-SHA1, a 30-second period and 6-digit output
• Compatible with Google Authenticator, Authy, Microsoft Authenticator and 1Password
• Runs 100% client-side using the Web Crypto API — your secret is never transmitted or stored
• Live countdown bar shows exactly when the code refreshes

Common uses

Developers use it to test TOTP integration without installing an app, support teams use it to verify enrollment flows, and power users keep a backup way to read codes from a secret they have saved securely. Treat the secret like a password — anyone with it can generate your codes.

Key features at a glance

• Implements the RFC 6238 TOTP standard (HMAC-SHA1, 30-second window, 6 digits)
• Accepts a Base32 secret with or without spaces and in any case
• Live 6-digit code with a countdown bar to the next rotation
• Compatible with Google Authenticator, Authy, Microsoft Authenticator and 1Password
• Runs 100% client-side via the Web Crypto API — your secret never leaves the device
• Works offline once the page is loaded

How a TOTP code is generated step by step

TOTP turns a shared secret and the current time into a short code through a deterministic chain of steps. First the current Unix time is divided by the time step (30 seconds) to get a counter that increments twice a minute. That counter is fed, along with the decoded secret, into HMAC-SHA1, producing a 20-byte authentication code. A process called dynamic truncation then selects four bytes from that output based on its last nibble, turning them into a number.

Finally that number is reduced modulo one million to give a six-digit code, zero-padded if needed. Because both your authenticator and the server run the identical calculation against the same secret and clock, they arrive at the same code independently — no message ever passes between them. This is why two-factor codes work even in airplane mode, and why the secret must be protected as carefully as a password.

TOTP versus HOTP and why time matters

TOTP is a time-based variant of an older standard called HOTP, which counts events instead of time. In HOTP the counter advances each time you request a code, so the server and client can drift out of sync if codes are generated but not used. TOTP replaces that counter with the clock, so codes expire automatically and there is nothing to keep in sync except the time itself.

That reliance on time is also TOTP's main practical caveat: if your device clock is significantly wrong, the codes will not match. Servers usually accept codes from the adjacent windows to tolerate small drift, but a clock that is minutes off will fail. Keeping your device set to automatic network time is the simplest way to avoid mysterious rejected codes.

Tips for working with TOTP secrets

• Save the Base32 secret (or its backup codes) somewhere safe when you enable 2FA
• Treat the secret like a master password — anyone with it can produce your codes
• If codes are rejected, check that your device clock is set automatically
• Spaces and lowercase in the secret are fine; the standard ignores them
• Use this tool as a backup, not a replacement for a dedicated authenticator app on your phone

Why choose our 2FA / TOTP generator?

Our generator is completely free with no signup, no limits, and no subscription. Critically for a security tool, every calculation runs locally in your browser using the Web Crypto API, so your secret is never transmitted, logged, or stored — it exists only in the page while you use it and is gone when you close the tab.

It is also one of more than 200 free tools on ToopTools, and you can pin it to your My Workspace, a personalized workspace where you arrange the tools you use most into a single dashboard. Keeping the TOTP generator beside the hash and token tools means your whole security toolkit is one click away whenever you are testing an authentication flow.

Common use cases

Developers use the generator to test a TOTP integration end to end without installing an authenticator app, confirming that their server derives the same codes from a given secret. QA and support teams use it to walk through enrollment and recovery flows and to reproduce reported issues.

Power users keep it as a backup way to read their codes from a secret they have stored securely, for example if their phone is unavailable. Security learners use it to see the standard in action and understand exactly how the code on their screen relates to the secret behind their accounts.

Is the TOTP generator free to use?

Yes. It is completely free with no account, no sign-up, and no usage limits. Generate as many codes as you need at no cost.

Is it safe to enter my 2FA secret here?

The calculation runs entirely in your browser and your secret is never sent anywhere. That said, treat any 2FA secret with care, only paste it on a device you trust, and prefer a dedicated authenticator app as your primary method.

Why is my code not matching the server?

The most common cause is an incorrect device clock, since TOTP depends on accurate time. Set your clock to update automatically. Also confirm you pasted the correct Base32 secret and that the service uses the standard 30-second, 6-digit configuration.

Which authenticator apps is this compatible with?

It follows the same RFC 6238 standard as Google Authenticator, Authy, Microsoft Authenticator, and 1Password, so a secret enrolled in any of them produces the same codes here.

What is a Base32 secret?

It is the text key shown under the QR code during 2FA setup, encoded in Base32 (letters A–Z and digits 2–7). Authenticator apps store this secret and combine it with the time to generate codes; this tool does the same.

Does it work offline?

Yes. Once the page has loaded, all code generation happens on your device with no network access required, which is exactly why TOTP works without an internet connection.

Can someone steal my codes from this tool?

Not through the tool itself — nothing is uploaded. The real risk is your secret. Anyone who obtains the Base32 secret can generate valid codes, so keep it confidential and only use trusted devices.

How do I generate a 2FA code from a secret key?

Paste the Base32 secret key your service gave you when setting up two-factor authentication, and the tool instantly generates the current 6-digit TOTP code, refreshing every 30 seconds. Enter that code on the site to complete login — exactly as a phone authenticator app would.

Can I use this instead of an authenticator app?

You can, for generating codes in a pinch, but treat it as a backup rather than your main authenticator. For everyday security, keep your secret in a dedicated app on your device; pasting it into any web page, including this one, is best reserved for testing or recovery.