TOTP Code Generator
Authenticator codes from a Base32 secret or otpauth URI, computed on device.
About this tool
Paste the secret key a site shows during 2FA setup (or an otpauth:// URI) and the current code appears with its countdown, exactly as an authenticator app would show it. Computed in your browser; the secret is never stored or sent.
How TOTP works, and when a web page is the right tool
Time-based one-time passwords are deliberately simple: a shared secret and the current 30-second window go through an HMAC, and six digits are pulled from the result (RFC 6238). Any correct implementation produces the same code, which is why this page can match Google Authenticator or Authy — it runs the same maths with your browser's WebCrypto. The honest uses: a developer testing a login flow without reaching for a phone; checking that a backup of a secret still generates valid codes before you need it; the moment the phone is dead and the secret is in your password manager. The honest cautions: a browser is only as trustworthy as the machine it runs on, so never type a secret on a shared or untrusted computer; the code depends on your clock being accurate; and a page is a fallback, not an authenticator — apps keep secrets encrypted and off the screen. The secret is cleared when you leave. The password generator and passphrase generator cover the first factor; the hash generator shows the HMAC family at work.
Frequently asked questions
Where do I find the secret?
When a site sets up 2FA it shows a QR code and, usually, a ‘can’t scan? enter this key’ string of letters and digits. That Base32 key is the secret; an otpauth:// URI (what the QR code contains) works too.
Why doesn’t the code match my app?
Almost always the clock: your device’s time must be right to within a few seconds. Less often the site uses 8 digits, a 60-second period or SHA-256 — set those to match.
Is the secret saved?
No — it lives in the input box while the page is open, is never sent anywhere, and is cleared when you navigate away.
Should I use this instead of an authenticator app?
No. It’s a fallback and a testing tool. Apps store secrets encrypted and off the screen; a browser tab doesn’t.