TOTP Code Generator
Generate 2FA TOTP codes from a secret key, otpauth link or QR screenshot
Runs entirely in your browser. Nothing you type or upload is sent to us or stored. How we handle privacy
Runs entirely in your browser. Nothing you type or upload is sent to us or stored.
Results are for general guidance. Please check anything important before relying on it. Terms of use
How to Use
- Paste the setup key (the Base32 text a site shows under its QR code) into Secret key. Spaces are ignored. You can also paste a full
otpauth://link. - Or drop a screenshot of the setup QR code into the box below, or paste it with Ctrl+V. The tool reads it and fills in the secret, issuer, account and settings.
- Leave Digits, Period and Algorithm at 6, 30 seconds and SHA-1 unless the site says otherwise.
- Read the current code. The ring counts down the seconds until it changes, and the next code is shown underneath.
- Tap Copy code and paste it into the site. Tap Clear when you're done; the secret is never saved.
What a TOTP code generator does
When you turn on two-factor authentication with an app like Google Authenticator or Microsoft Authenticator, the site gives your app a secret key, usually inside a QR code. From then on, the app and the site both use that secret and the current time to work out the same 6-digit code every 30 seconds. That code is a TOTP, short for time-based one-time password. This TOTP code generator does the same calculation in your browser, so you can test a 2FA setup you're building, check a secret you saved as a backup, or see exactly how the codes are made.
The secret never leaves this page. It isn't sent anywhere and isn't stored, not even in your browser, and it is gone when you close the tab.
How the code is calculated
TOTP is defined in RFC 6238, published in 2011, and builds on HOTP from RFC 4226. The steps are:
hash = HMAC-SHA1(secret, counter as 8 bytes)
offset = last 4 bits of hash
number = 4 bytes of hash from offset, top bit cleared
code = number mod 10^6, padded with zeros to 6 digits
Because both sides use the clock, the code only works if your device's time is correct. Many sites also accept the code from one step before or after, which allows for a small clock difference.
A worked example from the RFC: with the secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ (the text "12345678901234567890" in Base32), at Unix time 59 the 8-digit SHA-1 code is 94287082. At time 1111111109 it is 07081804. This tool gives exactly these values, and its tests check them.
The settings
| Setting | Usual value | Notes |
|---|---|---|
| Digits | 6 | A few systems use 8 |
| Period | 30 seconds | A few systems use 60 |
| Algorithm | SHA-1 | SHA-256 and SHA-512 exist, but some apps ignore them |
| Secret | 16 to 32 Base32 characters | Letters A to Z and digits 2 to 7 only |
A setup QR code holds a link like otpauth://totp/GitHub:rahul?secret=JBSWY3DPEHPK3PXP&issuer=GitHub. Paste such a link, or drop a screenshot of the QR code, and the tool fills in everything, including the issuer and account name.
Using it safely
- Whoever has your TOTP secret can make your codes. Treat it like a password and never share it, or a screenshot of the QR code, with anyone.
- Don't keep the secret in the same place as the account password. If both leak together, two-factor protection is gone.
- When you set up 2FA, save the site's recovery codes as well. They get you back in if you lose your phone.
- Your bank's SMS OTP is a different system. Banks send those codes to you; they aren't generated from a secret you hold, so this tool can't make them.
- For everyday logins, use an authenticator app on your phone. This page is best for testing, developer work and one-off checks.
If the codes here don't match your app or are rejected, check the device clock first (set it to automatic), then the digits, period and algorithm.