Generate time-based 2FA codes from a Base32 secret, with a live countdown and an otpauth:// URI for authenticator apps. Runs in your browser.
First time here? Paste your Base32 secret, or generate a random one Your input is processed locally and disappears when you close the tab.
A TOTP code is just a hash of a shared secret and the current time, which means anything holding the secret can produce it. This free totp generator does exactly that in your browser, with a live countdown showing how long the current code has left.\n\nIt exists for three honest reasons: testing a two-factor implementation you are building, recovering an account when you still have the secret but not the phone it was set up on, and verifying that a stored backup secret actually produces the codes you expect before you need it in an emergency.\n\nThe defaults — SHA-1, six digits, thirty seconds — are what virtually every service uses, and the other options are there for the rare implementation that deviates. SHA-1 looks alarming given it is broken for collisions, but TOTP uses it inside HMAC where that weakness does not apply; RFC 6238 specifies it and changing it would break compatibility for no benefit.\n\nBeing clear about what this is not: nothing is saved. Reload and the secret is gone, and a browser tab is not a safe long-term home for credentials. Use a real authenticator app for accounts you depend on. The secret is never transmitted, which is the point — a 2FA secret sent to a server is a 2FA secret you no longer control. Copy the otpauth:// URI into our QR Code Generator to produce a scannable setup code.
Paste your Base32 secret, or generate a random one
Adjust algorithm, digits or period only if your service differs
Read the current code and its countdown
Copy the otpauth:// URI if you need a QR code
The string a site shows you when it says “can't scan the QR code?”
This is a testing and recovery tool, not a password manager. Nothing is saved — reload the page and the secret is gone. Use a real authenticator app for accounts you rely on, and keep the secret somewhere safe.
Codes are computed in your browser from the current time. The secret is never transmitted, which is the entire point — a 2FA secret sent to a server is a 2FA secret you no longer control.