TOTP code generator (2FA)
Get the same time-based codes your authenticator app shows from its secret key, or create a new secret with its QR code to implement two-step verification in your own application. Fully RFC 6238 compliant.
Processed 100% in your browser
Ctrl + Enter runCtrl + C copy result
How to use
- 1Paste the Base32 secret or a full otpauth:// URI (all parameters are imported).
- 2Adjust digits, period and algorithm if the service does not use the defaults (6, 30 s, SHA-1).
- 3Copy the current code with one click; the ring shows the seconds left.
- 4To set up an app, scan the generated QR and test a code under “Verify”.
Use cases
- Test your website or API’s 2FA implementation during development.
- Generate secrets and QR codes to enroll users in authenticator apps.
- Regain access when you have the backup secret but not the phone.
- Debug clock drift between server and device.
Frequently asked questions
What is TOTP?
Time-based One-Time Password: a single-use code computed from a shared secret key and the current time (RFC 6238). It is what Google Authenticator, Microsoft Authenticator, Authy and 1Password generate.
Is it safe to paste my secret here?
The calculation runs in your browser with Web Crypto and the secret is never sent or stored. Still, treat the secret like a password: anyone holding it can generate your codes. For real accounts, keep it only in a trusted manager or app.
Why does my code not match?
It is almost always the clock: TOTP depends on the exact time. Sync your device time. Also check that digits, period and algorithm match the service.
What does an otpauth:// URI contain?
The secret, the service and account names and, optionally, algorithm, digits and period. It is exactly what the QR code you scan when enabling two-step verification encodes.