TOTP / 2FA Code Generator

The six digits your authenticator app shows every thirty seconds aren’t random. They’re an HMAC signature over the current time, truncated down to something short enough to type before it expires. TOTP Generator runs that exact RFC 6238 algorithm locally, signing with the browser’s own crypto.subtle implementation rather than a hand-rolled substitute.

Reach for it when you’re debugging a 2FA integration and need to see what code your server should be expecting without reaching for your phone, checking a backup secret before you commit to relying on it, or building something that consumes TOTP codes and needs known-good test values. Paste a secret, or generate a fresh one, and a code appears immediately.

Running Your First Code

1. Paste a Base32 secret into the Base32 Secret field, exactly the string an app would show under “Can’t scan this code?”, or click the dice icon for a random one.
2. Watch the code fill in on its own. A bad character produces a message instead of a blank field, such as “Invalid Base32 character: "1" — only A–Z and 2–7 are allowed.”
3. Leave Algorithm, Digits and Period on their defaults unless you’re testing a non-standard setup — SHA-1, 6 digits, 30 seconds is what real authenticator apps expect.
4. Click Copy before the progress bar fills, or check the Previous / Next row underneath if the code you typed elsewhere doesn’t match what’s shown here.

How It Calculates the Code

Every code is HOTP(secret, counter) truncated to however many digits you asked for, where counter is the current Unix time divided by the period and rounded down — RFC 6238 layered on RFC 4226’s HMAC-based one-time password. A freshly generated secret decodes to 20 bytes, a 160-bit key, which is the length HMAC-SHA1 is built around; a shorter pasted secret still works, just from less entropy. This implementation has been checked against all four published RFC 6238 test vectors, the same seed and timestamps the spec itself uses to verify a compliant implementation, and matches every one of them exactly.

When Not to Use This for a Live Account’s Secret

Typing a real account’s TOTP secret into any web page, this one included, gives that page’s JavaScript the same access to it a keylogger would have. That trade is fine for a throwaway secret you generated to test something, and it is not fine for the secret behind your email or your bank. Nothing here is written to disk: the value lives in React state and disappears on refresh, but “gone on refresh” is a much weaker guarantee than a dedicated authenticator app makes. For an account that actually matters, use the app your provider issued the QR code for in the first place.