TOTP Code Generator
Generate two-factor authentication codes from a secret or otpauth link.
The Six-Digit Codes, Computed Where You Can See Them
The codes in an authenticator app are not magic: each one is an HMAC of the current 30-second time window, keyed by a secret the service gave you when you set up two-factor authentication — the algorithm published as RFC 6238. Paste that secret, or the whole otpauth:// link, and this page computes the same codes your app would.
Developers use it to test a 2FA integration without reaching for a phone; administrators use it to confirm a secret is correct before relying on it. It can also generate a new random secret and show it as a QR code for an app to scan. The secret stays in this tab and is never stored.
Key features
- Standard TOTP — RFC 6238 over RFC 4226 HOTP, with WebCrypto HMAC.
- Secret or otpauth link — algorithm, digits and period read from the link.
- SHA-1, SHA-256 and SHA-512 — 6, 7 or 8 digits, 15 to 60-second periods.
- Previous and next codes — for checking clock drift.
- New secrets with QR codes — 160-bit random secrets ready to enrol.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: TOTP Code Generator
- Paste the secret
The Base32 key a service shows, or its otpauth:// link. - Check the settings
Nearly every service uses SHA-1, 6 digits and 30 seconds. - Read the code
It changes every period; tap it to copy. - Or set up a new secret
Generate one and scan the QR code with your authenticator app.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Why does my code not match my app?
Almost always the clock. TOTP codes depend on the current time, so a device clock that is a minute out produces different codes. Turn on automatic time setting on both devices. The previous and next codes help show whether one side is ahead or behind.
Is it safe to paste a 2FA secret into a web page?
The code here runs entirely in your browser and sends nothing anywhere, but a 2FA secret is as sensitive as a password. Only paste real secrets on a device you trust, and prefer test secrets when developing.
Where do I find my secret key?
When you enable two-factor authentication, most services offer a link such as “can’t scan the QR code?” that reveals the key as text. Once setup is finished, services do not usually show it again.
What is an otpauth link?
The URI inside a 2FA QR code, such as otpauth://totp/Service:yourname?secret=…&issuer=Service. It carries the secret together with the name and settings, and can be pasted here directly.
Is TOTP the same as SMS codes?
No. SMS codes are sent to your phone number each time; TOTP codes are calculated on your device from a shared secret, which is why they work offline and resist SIM-swap attacks.