TOTP Generator (2FA Code Tester)

Generate real TOTP codes free online from any base32 secret, following the RFC 6238 standard used by Google Authenticator and Authy. Real HMAC-SHA1 via Web Crypto API.

Base32 Secret Key

------

Enter a secret to begin

Real RFC 6238 TOTP via Web Crypto HMAC-SHA1 -- runs entirely in your browser.

How to Use This Tool

Enter your base32 secretPaste the secret key from your 2FA setup

Watch the live codeA real 6-digit TOTP code generates and refreshes every 30 seconds

Copy when neededUse the copy button to grab the current code

Real TOTP Generation, Not a Simulated Countdown

Two-factor authentication codes that refresh every 30 seconds are not random -- they are deterministically calculated from a shared secret and the current time, using HMAC-SHA1 following the RFC 6238 standard. This tool implements that exact algorithm using the Web Crypto API's HMAC support, producing codes that genuinely match what Google Authenticator, Authy, or any RFC 6238-compliant app would generate from the same secret.

This is useful both for understanding how TOTP actually works under the hood and for developers who need to test 2FA integration without reaching for their phone on every debugging iteration.

The Algorithm Behind the Six Digits

The current Unix time, divided into 30-second steps, gets combined with the base32-decoded secret using HMAC-SHA1. A specific truncation step (dynamic truncation, as defined in the RFC) extracts a 6-digit code from the resulting hash. Because both your device and the verifying server perform this exact same calculation independently, no communication is needed between them during code generation -- only the shared secret and synchronized clocks.

Why Clock Synchronization Actually Matters

If a device's clock drifts significantly from real time, the 30-second window it calculates will not match the server's window, and codes will fail to validate even though the secret is correct. This is the most common real-world cause of "my 2FA code keeps failing" -- not a wrong secret, but clock drift, which is why most authenticator implementations allow a small window of tolerance (typically one step before and after).

Frequently Asked Questions

Yes, when given the same base32 secret. TOTP (Time-based One-Time Password) follows RFC 6238, an open standard that all major authenticator apps implement identically. The same secret and the same moment in time will always produce the same 6-digit code regardless of which compliant app generates it.

It is the shared secret key that an account's 2FA setup gives you, usually shown as a QR code or a short text string when you first enable two-factor authentication. Scanning that QR code is what populates your authenticator app with this exact secret.

RFC 6238 specifies a 30-second time step by default. Both your device and the server calculate the code using the current Unix timestamp divided into 30-second windows, so as long as both clocks are reasonably synchronized, they compute matching codes without ever communicating during code generation.

Generally yes for testing purposes since everything runs locally in your browser with nothing transmitted, but treat your TOTP secrets with the same care as a password -- anyone with the secret can generate valid codes for that account indefinitely, so avoid leaving secrets visible on shared screens or saved in browser history on shared devices.

Developers building or debugging 2FA integration need to verify their server-side TOTP validation logic actually accepts correctly generated codes. This tool lets you test against a known secret without needing your phone for every debugging cycle.