TOTP Generator (2FA Codes)
Enter a Base32 secret to see the current six-digit authenticator code with a countdown, check codes from an app, and create an otpauth:// link and QR code for testing two-factor sign-in.
Verify a code
Set up an authenticator app
The secret and codes never leave this page. The QR code is drawn in your browser, not by an outside service.
How to generate and test TOTP codes
- Paste a Base32 secret (or a full otpauth:// link) into the box, or click “New random secret” to make one.
- The current code appears with a ring showing how long it has left. Previous and next codes are shown too, which helps when clocks drift.
- Type a code from an authenticator app into “Verify a code” to check it, or scan the QR code with an app to set up a test account.
How TOTP works
Time-based one-time passwords (RFC 6238) are what authenticator apps such as Google Authenticator, Microsoft Authenticator, Authy and 1Password show. The server and the app share a secret key. Every 30 seconds both compute an HMAC of the current time step (the Unix time divided by 30) with that key, then turn the result into a six-digit number. Because both sides use the same secret and clock, the codes match without any network connection.
Most services use the defaults: SHA-1, six digits and a 30-second period. Some use SHA-256 or eight digits; those settings are included in the otpauth:// link so apps pick them up automatically. Servers usually accept the code one step before or after the current one to allow for clock drift, which is why the previous and next codes are shown.
For developers
Use this page to check your own 2FA implementation: generate a secret, scan the QR code into a phone app, and compare the codes your server produces. The example secret loaded at the start is the RFC 6238 test key, so you can check your code against the published test vectors. Secrets should be at least 128 bits (26 Base32 characters); 160 bits is common.
Do not paste the secret of a real account into any website you do not control. This page runs entirely in your browser and sends nothing anywhere, but a 2FA secret is as sensitive as a password.
Need a different tool? Suggest it here — we read every message.
Frequently asked questions
Why does my code not match my authenticator app?
Check that the secret, algorithm, digits and period are the same, and that your device clock is correct. A clock that is a minute off gives different codes; use the clock offset box to test drift.
What is Base32?
An encoding that uses the letters A–Z and digits 2–7. It is how 2FA secrets are shown when you choose “enter key manually” in an app. Spaces and lowercase letters are ignored.
Can I scan the QR code with my phone?
Yes. It contains a standard otpauth:// link that any authenticator app can read.
Is it safe to use?
Everything runs locally: the HMAC is computed with your browser’s Web Crypto and the QR code is drawn on the page. Still, use test secrets here rather than the secrets of real accounts.
Is anything sent to a server?
No. Everything is calculated in your browser, and nothing you enter leaves your device.