TOTP / 2FA Code Generator
Generate live TOTP two-factor codes (RFC 6238) from a Base32 secret, with a countdown and an otpauth:// enrollment QR. Free, no upload, in your browser.
The Base32 key your service shows when you set up 2FA (spaces are ignored).
Enter your secret key above to see the live code.
Options
Most authenticator apps use SHA-1, 6 digits, 30 s — change these only if your service asks for it.
Enrollment QR code
Scan with Google Authenticator, Authy, 1Password, etc. to add this account.
Paste this into a desktop authenticator instead of scanning — the QR above carries exactly this string.
🔒 Codes are computed in your browser with WebCrypto — your secret never leaves this page.
Time-based one-time passwords, generated in your browser
Paste the Base32 secret a service gives you when you turn on two-factor authentication and this tool shows the current TOTP code, refreshing every period with a countdown bar — exactly what an authenticator app displays. It implements RFC 6238 on top of RFC 4226 HOTP and is verified against the official RFC test vectors.
Codes are computed locally with your browser's WebCrypto HMAC — your secret is never uploaded or stored, so the tool works offline. Switch to 8 digits, a 60-second period or SHA-256/SHA-512 if your service requires it, and generate an otpauth:// enrollment QR code to add the account to Google Authenticator, Authy, 1Password and other apps.
Frequently asked questions
What is a TOTP / 2FA code?
A TOTP (Time-based One-Time Password, RFC 6238) is the 6-digit code an authenticator app shows for two-factor authentication. It is derived from a shared secret and the current time, so it changes every 30 seconds and can be verified without any network call.
Is my secret key uploaded anywhere?
No. The secret stays in your browser and every code is computed locally with WebCrypto HMAC. Nothing is sent to a server, which also means the tool keeps working offline.
Which authenticator apps does the QR code work with?
The enrollment QR encodes a standard otpauth:// URI, so it scans into Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and most other TOTP apps.
Why does the code change every 30 seconds?
TOTP splits time into fixed windows (the period, 30 seconds by default). A code is valid for its window and then rolls over. The progress bar shows how long the current code remains valid.
Can I use 8 digits or SHA-256?
Yes — open Options to switch to 8 digits, a 60-second period, or the SHA-256 / SHA-512 hash. Most services use the SHA-1 / 6-digit / 30-second default, so only change these if your provider asks you to.