TOTP Generator

Generate TOTP (time-based one-time password) codes from any base32 secret. The code refreshes every 30 seconds, in lockstep with what Google Authenticator, Authy, or 1Password would produce. Paste an <code>otpauth://</code> URI to extract the secret, or paste the base32 directly.

How TOTP actually works

A TOTP code is HMAC-SHA-1(secret, current_30s_interval) truncated to 6 decimal digits. Every 30 seconds, both your authenticator and the server compute the same value independently. Match → authenticated.

The clock-based design eliminates the need for a counter sync between client and server (the issue HOTP had) but introduces a new requirement: clocks must agree within a few seconds. Most servers accept a code from the previous and next interval to handle drift.

What this tool gives you

• Live code panel — refreshes every 30s with a countdown
• otpauth URI parser — paste the QR-encoded URI, secret extracts
• Multi-account view — store several secrets locally during a session
• Algorithm options — SHA-1 (default per RFC 6238), SHA-256, SHA-512

Generating TOTP in code

Verify the shape here, then implement with a maintained library — never hand-roll the HMAC:

JavaScript / Node / React Native / Expo (otpauth):

import * as OTPAuth from "otpauth";
const totp = new OTPAuth.TOTP({ secret: OTPAuth.Secret.fromBase32("JBSWY3DPEHPK3PXP") });
totp.generate();            // current 6-digit code
totp.validate({ token });   // returns time-step delta or null

Python (pyotp):

import pyotp
pyotp.TOTP("JBSWY3DPEHPK3PXP").now()          # current code
pyotp.TOTP(secret).verify(token)              # True/False

otpauth is the go-to for React Native and Expo because it is pure JS with no native module. The common bug is a base32 secret with lowercase or padding differences — paste it here first to confirm it decodes and produces the code you expect.

Common workflows

Develop against a 2FA service. Generate the secret, set up your test account, plug the secret into this tool. Codes appear without an authenticator app on your phone.

Recover after losing your phone. If you saved the seed (you should), paste it here as a temporary authenticator until you provision a new device.

Audit a 2FA implementation. Compare codes from this tool against what your server-side library produces. Mismatch flags a bug.

Quick sanity check. Verify a service’s 2FA enrollment QR encodes a valid otpauth:// URI by pasting the QR-decoded URI here.

Why a browser-side TOTP

Your TOTP secret is high-value — anyone with it can generate codes for the rest of time, until the secret rotates. Pasting it into a remote tool is risky. Local computation, no logs, no transmission, no persistence — the same mathematical answer your phone app would produce, computed in your browser.

Last updated: 2026-07-04