TOTP Generator Developer Tool
Generate live RFC 6238 TOTP codes from a Base32 secret, entirely in your browser.
Implementing your own two-factor authentication needs a way to check the codes your server generates actually match what an authenticator app would produce — without pulling out your phone every time. This free TOTP generator is a developer tool that computes live, auto-refreshing RFC 6238 time-based one-time-password codes from a Base32 secret, entirely in your browser.
Secret
Current code
30s until next code
otpauth URI
This URI isn't rendered as a QR code here — paste it into any otpauth-aware QR generator if you need one.
Runs entirely in your browser — no data is sent anywhere.
How TOTP actually works
A Time-based One-Time Password (RFC 6238, built on the HOTP algorithm from RFC 4226) turns a shared secret and the current time into a short numeric code that both sides — your server and the user's authenticator app — can independently compute without any network round trip. The current Unix time is divided by a fixed step (30 seconds here, the near-universal default), producing a counter that increments once per interval. That counter is HMAC'd with the secret (SHA-1 is what virtually every authenticator app expects, despite SHA-1 being deprecated elsewhere) and the result is put through "dynamic truncation" — using the last 4 bits of the HMAC output as an offset into itself to pull out 4 bytes, masking off the top bit, and reducing modulo 1,000,000 to get a 6-digit code. Because both sides compute this from the same secret and the same time step, no code ever has to be transmitted or stored anywhere for the check to work.
Why this is a testing tool, not a vault
This page is built for developers implementing their own TOTP verification logic server-side and needing a fast way to confirm their implementation's output matches what's expected — not for generating or holding onto codes for a real account. Don't use it as a substitute for an actual authenticator app on your real, production 2FA-protected accounts: paste a real secret into a browser tab and it exists in that tab's memory and clipboard history for as long as you leave it there, which is exactly the kind of casual exposure a dedicated authenticator app or password manager is built to avoid.
Reading the otpauth URI
The otpauth://totp/... URI is the standard format authenticator apps use to import a secret via QR code — it bundles the secret, issuer name, and account label into one scannable string. This tool builds that URI from your inputs so you can see its exact shape, but doesn't render it as an actual QR code since no QR library is available here; if you need a scannable code for onboarding a real user, feed this URI into a dedicated QR code generator.
Same philosophy as the JWT decoder
Like the JWT decoder, everything here runs locally using the Web Crypto API — nothing about your secret or generated codes is transmitted anywhere, which matters given what's at stake if a 2FA secret leaked. If you need a fresh, high-entropy value to use as a secret while testing (or for anything else needing a random credential), the API key generator covers that same cryptographically random generation with different output formats.