TOTP Code Generator
Generate the current two-factor code from a Base32 secret or otpauth:// URI, with the previous and next codes for clock skew.
Local workspace
Named projects in IndexedDB · Local only — never synced to our servers. Worksp…
Options
| Option | Description |
|---|---|
| Secret | Used when the input is empty. It is never saved, put in a URL, or included in the output. |
| Digits | Code length. Almost every service uses 6. |
| Period | How long each code is valid. An otpauth:// URI overrides this. |
| Algorithm | SHA-1 is what authenticator apps and most services expect, despite the name. |
FAQ
How does a TOTP code work?
The current Unix time is divided by the period to get a counter, that counter is signed with the shared secret using HMAC, and part of the result is truncated into digits. Both sides compute it independently, so the code itself never travels to the server ahead of time.
Why show the previous and next codes?
Servers usually accept one step either side to tolerate clock drift. Seeing all three helps when a code is rejected: if the previous or next one works, the clock is off rather than the secret being wrong.
Where do I find the Base32 secret?
During two-factor setup, choose the manual entry or "can't scan the code" option. The same value sits in the secret parameter of the otpauth:// URI encoded in the QR code.
Is it safe to paste a real two-factor secret here?
Everything runs in your browser and nothing is saved or shared, but a secret pasted into any tool is a copy of your second factor. Use an authenticator app for accounts that matter, and this tool for testing, automation, and recovering a code when your phone isn't at hand.
Which algorithms and code lengths are supported?
SHA-1, SHA-256, and SHA-512, with six to ten digits and any period. Services almost always use SHA-1 with six digits and 30 seconds, even though the name suggests otherwise.