TOTP / OTP Generator
Current Code
------
How to use this OTP generator
- Paste the Base32 secret key shown when you set up 2FA (often shown as text next to a QR code).
- A 6-digit code generates instantly and refreshes every 30 seconds.
- Use it exactly like you would a code from Google Authenticator or similar apps.
How does TOTP work?
Time-based One-Time Password combines a shared secret key with the current time (rounded to a 30-second window) using HMAC-SHA1, producing a 6-digit code that both you and the server can compute independently without any network communication.
Is it safe to paste my 2FA secret into a website?
Everything here runs locally in your browser and the secret is never transmitted anywhere, but as a general habit, only paste 2FA secrets into tools you trust and understand — this one included.
Why doesn't the code match my authenticator app?
This usually means your device's clock is out of sync — TOTP relies on both sides having accurate time within a small tolerance window, so check your system clock if codes consistently mismatch.
How TOTP actually derives a code from time
TOTP works by turning the current time into a counter, then running that counter through HMAC using the shared secret as the key. Specifically, the current Unix timestamp is divided by 30 (the standard time step) and rounded down, producing a counter that only changes once every 30 seconds. That counter is hashed with HMAC-SHA1 using the secret key, producing a 20-byte hash output, which then goes through a step called dynamic truncation: a specific byte of the hash selects an offset, four bytes starting at that offset are extracted and interpreted as a number, and that number is reduced modulo 1,000,000 to produce the familiar 6-digit code. Both the client and server run this exact same deterministic process independently, which is why no network communication is needed for the codes to match — they're both computing the same function of the same shared secret and the same current time.
Why the 30-second window has to tolerate clock drift
TOTP's security depends on both sides agreeing closely on the current time, but device clocks aren't perfectly synchronized in practice, so the standard builds in tolerance rather than requiring exact agreement. Server implementations typically accept not just the code for the current 30-second window, but also the code for the immediately preceding (and sometimes following) window, which absorbs a small amount of clock drift without weakening security meaningfully, since it only widens the valid window by a matter of seconds. If codes consistently fail to match despite typing them correctly and quickly, the most common cause by far is a device clock that has drifted noticeably out of sync, which is worth checking (and correcting via automatic time sync) before assuming the secret itself is wrong.
Why the secret itself is the actual credential
Two-factor authentication is typically framed as combining "something you know" (a password) with "something you have" (a device generating codes), but the "something you have" is really just possession of the secret key — the code itself is derived from it. This means the Base32 secret string is functionally equivalent to a password in terms of what it protects: anyone who has it can generate valid codes indefinitely, exactly as if they had your authenticator app, without needing your physical device at all. This is why 2FA setup screens display the secret only once, usually alongside a QR code, and why it deserves the same handling caution as a password — pasting it into any tool, this one included, means trusting that tool with full, ongoing code-generation capability, not just a one-time code.
Why the secret is Base32-encoded specifically
TOTP secrets are almost universally shown in Base32 rather than the more common Base64 or hexadecimal, for a practical, human-facing reason: Base32's alphabet avoids visually ambiguous characters (no 0 versus O, no 1 versus I versus l) and is case-insensitive, both of which matter specifically because 2FA secrets sometimes have to be typed manually when a QR code can't be scanned. Base64 packs data more densely but uses a mixed-case alphabet plus symbols that are easy to mistype or transcribe incorrectly, while hexadecimal, though unambiguous, produces a noticeably longer string for the same amount of underlying data. Base32 is a deliberate middle ground optimized for a human occasionally having to type it correctly, not for storage efficiency.
Limitations of this tool
This generator computes a TOTP code from one secret at a time, entered manually, and doesn't store or manage multiple accounts the way a dedicated authenticator app does — every time you reload the page or navigate away, the secret is gone unless you re-enter it, which is a deliberate privacy choice (nothing persists) but a real convenience tradeoff compared to an app built to hold many accounts securely long-term. It also relies entirely on your device's system clock being reasonably accurate, since there's no server round-trip to correct for drift the way some networked authentication systems can. For managing 2FA across multiple everyday accounts, a dedicated authenticator app remains the more practical tool — this generator is better suited to testing, understanding how TOTP works, or a one-off code when you have the secret on hand.