TOTP Generator

TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind most 2FA/MFA apps including Google Authenticator, Authy, and Microsoft Authenticator. It works by combining a shared secret key with the current Unix timestamp (divided into 30-second windows) using HMAC-SHA1 to produce a 6-digit code. Because both your device and the server independently compute the code from the same secret and timestamp, they generate matching codes without any communication — making interception pointless since codes expire in 30 seconds.

When enabling 2FA on a service, you're usually shown a QR code. Most services also offer a 'Can't scan? Enter manually' option that reveals the raw Base32 secret — a string of letters A-Z and digits 2-7, usually 16–32 characters (e.g., JBSWY3DPEHPK3PXP). Copy this and paste it here. You can also extract the secret from a QR code using a QR scanner app — the URL format is: otpauth://totp/Account?secret=YOURSECRET&issuer=Service

Yes. This tool implements the standard TOTP algorithm: RFC 6238, HMAC-SHA1, 6-digit output, 30-second time window. This is identical to Google Authenticator, Authy, Microsoft Authenticator, 1Password TOTP, Bitwarden Authenticator, and virtually all TOTP-compatible apps. If you enter the same secret, you'll get the same code as your authenticator app (within the same 30-second window).

No. All computation happens entirely in your browser using the Web Crypto API (crypto.subtle.importKey and crypto.subtle.sign for HMAC-SHA1). Your secret key is never transmitted to any server or stored in any database. This tool also works offline once the page is loaded.

The counter value fed to HMAC is floor(UnixTimestamp / 30) — it advances by 1 every 30 seconds. Each counter value produces a unique 6-digit code. The countdown timer shows how many seconds remain in the current 30-second window. The 'next code' preview shows the code for the upcoming window so you can avoid entering a code that will expire in 1-2 seconds.

TOTP codes are time-sensitive — if your device clock is off by more than 30 seconds, codes will be wrong. (1) Sync your device clock with an NTP server. On Android: Settings → Date & Time → Sync. On iOS: Settings → General → Date & Time → Set Automatically. (2) Double-check that you're using the correct Base32 secret — even one wrong character produces completely different codes. (3) Make sure the service uses standard TOTP (30-second period, SHA1) — some use SHA256 or 60-second windows (uncommon).