TOTP / 2FA Code Generator
Generate time-based one-time passcodes (2FA codes) from a base32 secret, entirely in your browser.
Advanced options (digits, period, algorithm)
What is TOTP / 2FA Code Generator?
A TOTP (Time-based One-Time Password) generator produces the same six- or eight-digit codes an authenticator app like Google Authenticator or Authy shows for two-factor authentication (2FA). TOTP works by combining a secret key — set up once between you and a service, usually shown as a QR code plus a base32 text string — with the current time, run through an HMAC-based algorithm defined in RFC 6238, to produce a short numeric code that changes on a fixed interval (30 seconds by default) and can't be predicted without knowing the secret. Because the code is derived purely from the secret and the clock, no network round-trip to the service is needed to generate one, which is what makes it work even when the device is offline. This tool implements the real algorithm client-side, primarily useful for debugging TOTP integrations, verifying a backup secret works, or generating a one-off code when a phone isn't available — not as a replacement for a dedicated authenticator app for everyday logins.
How to Use TOTP / 2FA Code Generator
- Paste the base32 secret your service showed you when setting up two-factor authentication (the long string of letters/numbers next to or below the QR code — not the QR code image itself).
- The current 6-digit code appears immediately, along with a countdown showing how many seconds until it refreshes.
- If your account was set up with a non-default digit count or time step (rare — some enterprise/self-hosted services do this), adjust the advanced options to match.
- Enter the code into your login prompt before the countdown reaches zero — codes are only valid for one time step.
Examples
Standard setup
Input: Secret: JBSWY3DPEHPK3PXP, 6 digits, 30s period
Output: A fresh 6-digit code every 30 seconds, matching what an authenticator app would show
8-digit code
Input: Same secret, digits set to 8
Output: An 8-digit code — some services (mostly enterprise SSO) use this instead of the 6-digit default
Common Mistakes
- Pasting the wrong string — some setup screens show a "backup code" or "recovery code" alongside the TOTP secret; only the base32 secret (typically 16-32 letters/digits) generates valid time-based codes.
- Waiting too long to enter the code after it's generated — if the countdown is about to hit zero, wait for the next code rather than racing the current one, since many services reject a code entered right at the boundary.
- Assuming this tool stores your secret for next time — it doesn't, by design; treat it as a one-off calculator, not a place to keep 2FA secrets long-term.
Why Use This Tool
- Runs the actual RFC 6238 TOTP algorithm client-side via the Web Crypto API — not a simulation or approximation.
- No account, no app install, no secret ever transmitted over the network.
- Useful for debugging TOTP integrations during development, not just for logging in.
- Supports non-default digit counts and time periods for the less common services that don't use the 6-digit/30-second standard.