TOTP / 2FA Code Generator
Generate live TOTP authentication codes from a secret key — test 2FA integrations entirely in your browser
Enter or generate a Base32 secret key to see a live TOTP code
About this tool
The TOTP / 2FA Code Generator produces live, auto-refreshing time-based one-time-password codes from a Base32 secret — the same codes an app like Google Authenticator or Authy would show, computed with the standard RFC 6238 algorithm directly in your browser. Paste in a secret (or generate a random one), and a 6- or 8-digit code updates automatically with a countdown showing exactly when it'll refresh. It also builds and parses `otpauth://` URLs — the same format encoded into 2FA setup QR codes — so you can round-trip between a raw secret and the URL format your app or documentation actually uses. SHA-1, SHA-256, and SHA-512 are all supported, along with custom digit counts and refresh periods for testing non-default configurations. The entire computation — HMAC, dynamic truncation, and the final code — runs through the Web Crypto API in your browser. Your secret is never transmitted anywhere, which matters given that a TOTP secret is exactly as sensitive as the 2FA codes it produces.
When to use it
- →Testing a 2FA integration during development without reaching for your phone every 30 seconds
- →Generating a backup code source when setting up a new service's two-factor authentication
- →Debugging a TOTP implementation by comparing computed codes against expected values
- →Verifying an otpauth:// URL is correctly formatted before embedding it in a QR code
Tips
- ◆Most consumer apps (Google Authenticator, Authy) use SHA-1, 6 digits, and a 30-second period — only change these if you know your target system uses something different.
- ◆Use the otpauth:// import field to quickly load a secret straight from a URL you've copied out of a QR code payload or a service's manual setup instructions.
- ◆Treat any secret you paste in here as sensitive — anyone with the secret can generate valid 2FA codes for that account.
Frequently asked questions
Is this the same algorithm my phone's authenticator app uses?
Yes — TOTP is a standardized algorithm (RFC 6238) built on HMAC-based one-time passwords (HOTP). Any correct implementation, whether it's Google Authenticator, Authy, or this tool, produces the identical code for the same secret, algorithm, digit count, and time period, because the math is fully specified by the standard rather than app-specific.
What's the difference between the secret and the otpauth:// URL?
The secret is the raw Base32-encoded key used in the HMAC computation — the actual sensitive credential. The otpauth:// URL wraps that secret together with metadata (account label, issuer name, algorithm, digits, period) in the single format that QR codes for 2FA setup encode, so a scanning app knows how to configure itself, not just what the secret is.
Why would I ever need SHA-256 or SHA-512, or a period other than 30 seconds?
The overwhelming majority of consumer 2FA uses SHA-1/6-digit/30-second by default, but the TOTP standard supports alternatives, and some enterprise or custom systems use them deliberately for a longer security margin or a different refresh cadence. These options exist here mainly for testing and verifying non-default TOTP configurations, not everyday use.
Is it safe to generate real account 2FA codes with an online tool?
The computation is 100% client-side — your secret is never sent to a server — but the safest practice for a production account's actual ongoing 2FA is still a dedicated authenticator app or hardware key, since this tool has no persistent, encrypted secret storage the way a real authenticator app does. It's best suited for testing, debugging, and one-off verification rather than as your daily-driver authenticator.