TOTP Code Generator

TOTP (Time-based One-Time Password) is defined in RFC 6238. It combines a shared secret key with the current Unix timestamp (divided into 30-second windows) and runs them through HMAC-SHA1 to produce a 6-digit code. Because both your app and the server share the same secret and use the same clock, they independently generate the same code at the same time.

When you set up 2FA in an app, the service gives you a secret key encoded in Base32 — the letters A-Z plus digits 2-7. This key is usually shown as a QR code, but most services also show the raw text version for manual entry. It looks like JBSWY3DPEHPK3PXP.

Yes. This tool implements the same TOTP algorithm (RFC 6238, HMAC-SHA1, 6 digits, 30-second period) that Google Authenticator, Authy, Microsoft Authenticator, and 1Password TOTP use.

No. All computation happens in your browser using the Web Crypto API (crypto.subtle). Your secret key is never transmitted to any server.

The code is derived from the current time window (floor(Unix time / 30)). Every 30 seconds, the window advances and a new counter value produces a new code. This time-bound nature means stolen codes become useless almost immediately.

The ring shows how many seconds are left in the current 30-second window. When it reaches 0, the code regenerates automatically. The 'Next code' preview shows what the next code will be so you can avoid entering a code that will expire in 1-2 seconds.