TOTP Generator

What this tool does

TOTP Generator computes the current RFC 6238 time-based one-time password for a base32-encoded secret, with configurable digit count, time period and hash algorithm (SHA-1/256/512), auto-refreshing with a live countdown, using the exact same algorithm as Google Authenticator, Authy and similar 2FA apps.

TOTP (time-based one-time password) is the algorithm behind nearly every app-based two-factor authentication code: a shared secret and the current time, run through HMAC and a digit-truncation step, produce a short code that changes every 30 seconds and that both the server and your authenticator app compute independently.

This generator implements that exact RFC 6238 algorithm, taking a base32 secret and computing the current code with your choice of digit count, time period and hash algorithm, refreshing automatically every second with a live countdown bar, the same mechanics running inside Google Authenticator, Authy and nearly every other TOTP app.

How to use TOTP Generator

1. Enter a base32 Secret (or press Generate a random secret for a test one).
2. Adjust Algorithm, Digits and Period if testing a non-default configuration.
3. Watch the current Code update automatically as time passes.
4. Copy the code before the countdown reaches zero.

Tips for better results

• The default settings (SHA-1, 6 digits, 30-second period) match what almost every real-world TOTP setup (Google Authenticator, GitHub, etc.) actually uses; only change them if you specifically know a service uses different parameters.
• This is excellent for testing your own 2FA integration during development, generate a secret here, configure it on both ends, and confirm the codes match without needing a phone.
• Entering a real account’s actual 2FA secret into any web page, including this one, reduces its security compared with keeping it only in a dedicated authenticator app; this tool processes everything locally but is still best used for testing and learning.
• The countdown bar shows exactly how long the current code remains valid; codes are time-window based, not single-use, so the same code works for any request made within that window.

Common use cases

• Testing a TOTP-based two-factor authentication integration during development.
• Understanding exactly how the RFC 6238 TOTP algorithm computes a code from a secret and the time.
• Generating a disposable TOTP secret and code for a local test environment.
• Verifying that a server-side TOTP implementation produces the expected code for a known secret.

Common mistakes to avoid

• Entering a real, production account’s 2FA secret here out of convenience; keep genuine 2FA secrets only in a dedicated, trusted authenticator app rather than any general-purpose web tool.
• Assuming a TOTP code is single-use; it’s valid for its entire time window (commonly 30 seconds), not just one use, which matters when debugging timing-related issues.
• Using non-default digit count, period, or algorithm settings without confirming the target service actually expects them; mismatched parameters will produce codes that never match.