Is this a substitute for a real authenticator app?

For actual account security, no, use a dedicated authenticator app or hardware key so your 2FA secret isn't sitting in a browser tab. This tool is meant for testing and debugging (verifying your own TOTP implementation, checking a code during development), and for generating a new secret plus its scannable QR code when setting one up.

Why does the code change every 30 seconds?

TOTP derives its code from the current Unix time divided into fixed-length periods (30 seconds by default), so both the generator and the verifier compute the same code as long as their clocks are reasonably in sync, without ever needing to communicate.

What's the difference between generating a code and generating a secret?

Generating a code takes an existing Base32 secret (one you already have, from a service's 2FA setup screen) and computes the current TOTP code from it. Generating a secret creates a brand-new random one, along with a scannable QR code and otpauth:// URI, for setting up 2FA on a service or in your own code for the first time.

Does this tool store or transmit the secret?

No. Everything, secret generation, QR encoding, and code computation, happens entirely in your browser; nothing is sent anywhere.

TOTP Generator - Generate 2FA Codes From a Secret

Overview

Introduction

Setting up or debugging two-factor authentication sometimes means needing to generate or check a TOTP code without reaching for your phone.

This tool computes live TOTP codes from a Base32 secret, or generates a brand-new secret with a scannable QR code, entirely in your browser.

What Is TOTP/2FA Authenticator & Token Generator?

An RFC 6238 TOTP (Time-based One-Time Password) generator: given a Base32-encoded secret, it computes the current 6- or 8-digit code, refreshing automatically as each time period elapses.

It can also generate a new random 160-bit secret and its otpauth:// provisioning URI, rendered as a scannable QR code, the same flow a service's "set up 2FA" screen walks you through.

How TOTP/2FA Authenticator & Token Generator Works

TOTP is HOTP (RFC 4226) with a counter derived from time: the current Unix timestamp is divided by the period length (30 seconds by default) and floored, giving a counter that increments once per period.

That counter is HMAC'd (SHA-1, SHA-256, or SHA-512) with the decoded secret, then "dynamically truncated" per RFC 4226 into a 6- or 8-digit code by taking 4 bytes at an offset determined by the HMAC output's last nibble, and reducing modulo 10^digits.

When To Use TOTP/2FA Authenticator & Token Generator

Use it to compute a current TOTP code from a secret you already have, when debugging your own 2FA implementation or verifying a backup code still works.

Use the secret generator when implementing 2FA in your own application and you need a real, correctly-formatted secret and provisioning QR code to test against.

Often used alongside QR Code Encoder & Decoder and HMAC Generator.

Features

Advantages

Implements RFC 6238 and RFC 4226 directly, matching real authenticator apps' output exactly for the same secret and time.
Supports all three common underlying hash algorithms (SHA-1, the near-universal default, plus SHA-256 and SHA-512).
Generates a real scannable QR provisioning code, not just the raw secret text, for setting up a new 2FA enrollment.

Limitations

A code's validity depends on your device's clock being reasonably accurate; a significantly skewed system clock produces a code that won't match what a correctly-synced verifier expects.
This tool doesn't store secrets between visits; refreshing the page loses any secret you generated or entered, by design, so nothing sensitive persists in browser storage.

Examples

Computing a code from an existing secret

Input

secret: JBSWY3DPEHPK3PXP, algorithm: SHA-1, digits: 6, period: 30

Output

123456 (changes every 30 seconds)

The secret is Base32-decoded, HMAC'd with the current 30-second time counter, and dynamically truncated into a 6-digit code, exactly as an authenticator app would.

Best Practices & Notes

Best Practices

Use a real authenticator app or hardware security key for actual account protection; this tool is for testing and development, not day-to-day 2FA usage.
When generating a new secret for your own application, store it securely (encrypted at rest) associated with the user account, the same way you'd store a password hash.
Double-check the algorithm, digit count, and period match what the verifying service or your own code expects; all three must agree for codes to validate.

Developer Notes

HOTP truncation follows RFC 4226 §5.3 exactly: the last nibble of the HMAC digest selects a 4-byte offset, the high bit of the first selected byte is masked off (to avoid sign-related implementation inconsistencies), and the resulting 31-bit integer is reduced modulo 10^digits. The TOTP counter is `floor(unixSeconds / period)`. Base32 encoding/decoding follows RFC 4648 §6.

TOTP/2FA Authenticator & Token Generator Use Cases

Computing a current TOTP code from a secret during development or debugging
Generating a new 2FA secret and provisioning QR code when implementing TOTP support in your own application
Verifying your own TOTP implementation's output matches the standard algorithm for a known secret and time

Common Mistakes

Using this tool as your actual day-to-day 2FA method instead of a dedicated authenticator app; a browser tab isn't where a real second factor should live.
Mismatching the algorithm, digit count, or period between generator and verifier; TOTP requires all three to match exactly, not just the secret.

Tips

If codes never seem to match a real service, check your system clock's accuracy first; TOTP is unforgiving of even a minute or two of clock drift.

TOTP/2FA Authenticator & Token Generator