Create time-based one-time passwords (TOTP) from your Base32 secret key, instantly and privately. Everything runs inside your browser, so your key is never uploaded or stored.
TOTP Authentication Code Generator
------
Refreshes in 30sRuns locally in your browser
Enter your secret key to generate a code.
Why Use an Online 2FA Code Generator?
Two-factor authentication adds a second proof of identity on top of your password. Most services that offer it rely on the TOTP standard, where a shared secret key and the current time produce a short code that changes every 30 seconds. Our generator implements that standard exactly, which makes it useful for testing, for recovering access when your phone is unavailable, and for learning how authenticator codes really work.
Because the calculation uses the Web Crypto API built into modern browsers, the secret key stays on your device. Still, treat any secret key like a password: only use this tool on a trusted device and never paste keys for critical accounts into websites you do not trust.
Generating a 2FA code is a short, deterministic calculation. Here is what happens each time you type a secret key into the generator.
Key decoding. The Base32 secret key you enter is cleaned of spaces and dashes, then converted into raw bytes.
Time counter. The current Unix time is divided by the period (usually 30 seconds) to produce a counter value that stays the same during each window.
HMAC calculation. The counter is signed with your key using HMAC (SHA-1 by default) through the browser's Web Crypto API.
Dynamic truncation. Four bytes of the result are selected using the last byte as an offset, then reduced to the number of digits you chose.
Display and refresh. The code appears with a countdown bar. When the window ends, a new code is calculated automatically.
Because the service you log in to performs the same calculation with the same key, both sides arrive at the same code without sending anything over the network. Read the full explanation in How TOTP Codes Work.
Features
Standards-based. Follows RFC 6238 (TOTP) and RFC 4226 (HOTP) so codes match mainstream authenticator apps.
Private by design. Calculations run locally. The tool does not save, log or transmit your secret key.
Flexible settings. Choose 6, 7 or 8 digits, 15, 30 or 60 second periods, and SHA-1, SHA-256 or SHA-512.
Live countdown. A progress bar shows exactly how long the current code remains valid.
One-click copy. Copy the code without spaces, ready to paste into a login form.
Fast and lightweight. No external libraries, trackers or web fonts are loaded by the tool itself.
Accessible. Keyboard friendly, high-contrast dark theme, and clear labels for screen readers.
Free forever. No registration, no installation and no limits.
Articles
In-depth explanations of two-factor authentication concepts.
It is a tool that calculates the same time-based one-time password an authenticator app would show, using a shared secret key and the current time.
Is it safe to enter my secret key here?
The calculation happens in your browser and the key is not sent anywhere by this tool. Even so, only enter keys on devices you trust, and avoid using any online tool for your most sensitive accounts if you are unsure.
Where do I find my secret key?
When you enable 2FA, most services show a QR code and a text key (often labelled "setup key" or "manual entry"). That text key is the Base32 secret you paste into the generator.
Why does my code not match the service?
The most common causes are a mistyped key, a wrong digit count or period, or a device clock that is out of sync. See Why Your 2FA Code Is Not Working.
Does the tool store my data?
No. Nothing is written to cookies, local storage or a database by the generator. Closing or refreshing the page clears the key.
What do SHA-1, SHA-256 and SHA-512 change?
They select the hash function inside HMAC. Most services use SHA-1 with 6 digits and 30 seconds, so keep those defaults unless your service says otherwise.
Is this the same as Google Authenticator?
It uses the same open TOTP standard, so with identical settings the codes are identical. It is not an official product of any authenticator brand.
Do I need an internet connection?
You need to load the page once. After that, code calculation does not require any network request.
Privacy Policy
Last updated: October 2026.
Information we process
The code generator runs entirely in your browser. Secret keys, settings and generated codes are never transmitted to our servers and are not saved in cookies or local storage.
Server logs
Like most websites, our hosting environment may record standard technical logs such as IP address, browser type and requested pages for security and performance purposes.
Advertising
This website displays advertisements delivered by a third-party ad network. Such networks may use cookies or similar technologies to show relevant ads and measure performance. We do not control these technologies, and you can limit them through your browser settings.
Children
This website is intended for a general audience and does not knowingly collect personal information from children.
Changes
We may update this policy from time to time. The date at the top shows the latest revision.
Terms of Use
Last updated: October 2026.
Acceptance
By using this website you agree to these terms. If you do not agree, please stop using the website.
Use of the tool
The generator is provided for lawful purposes such as testing, learning and accessing accounts that you own or are authorised to use. You must not use it to access accounts without permission.
No warranty
The website and its content are provided "as is" without warranties of any kind. We do not guarantee uninterrupted or error-free operation, and codes should be verified with the service you are signing in to.
Your responsibility
You are responsible for protecting your secret keys and accounts. We are not liable for any loss or damage resulting from the use or misuse of this website.
Third-party content
Advertisements and external links belong to third parties. We are not responsible for their content or practices.
What Is Two-Factor Authentication (2FA)?
Two-factor authentication, usually shortened to 2FA, is a security method that asks for two different kinds of proof before letting you into an account. The first is normally your password, something you know. The second is something you have, such as a phone running an authenticator app, or something you are, such as a fingerprint.
Passwords alone are fragile. They are reused across sites, guessed, leaked in data breaches and stolen by malware. When a second factor is required, a stolen password is no longer enough, because the attacker also needs the second item.
Common types of second factors
Time-based one-time passwords generated by an authenticator app
Codes sent by SMS or voice call
Hardware security keys that follow FIDO2 or WebAuthn
Push approvals inside a mobile app
Single-use backup codes for emergencies
Time-based codes are popular because they work offline and are supported almost everywhere. Learn how they are produced in How TOTP Codes Work.
How TOTP Codes Work
TOTP stands for Time-based One-Time Password and is defined in RFC 6238. It lets a service and your device agree on a short code without communicating at the moment of login. Both sides hold the same secret key and both read the same clock.
The calculation
The current Unix time is divided by the time step, normally 30 seconds, and rounded down to give a counter. That counter is signed with the secret key using HMAC. A small portion of the result is extracted through dynamic truncation and reduced to a number with six or more digits. As soon as the time step changes, the counter changes and an entirely different code appears.
Why it is secure
Each code is valid for a very short time and is useless after that. Knowing one code reveals nothing practical about the next, because the HMAC function cannot be reversed to discover the key. Services usually tolerate a small clock difference by also accepting the previous or next code.
The security of the whole system depends on keeping the shared key secret, which is covered in What Is a 2FA Secret Key.
What Is a 2FA Secret Key and How to Protect It
The secret key is a random value, usually written in Base32 characters (A–Z and 2–7), that your account and your authenticator share when you enable 2FA. It is the ingredient from which every future code is calculated. Anyone who has the key can generate valid codes forever, so it deserves the same care as a password.
Where the key comes from
During setup, a service displays a QR code. That QR code simply contains the secret key and a few settings in an otpauth link. Most services also show the key as text for manual entry. This text is what the generator on this website expects.
How to protect it
Store it only in a password manager or an encrypted note, never in plain screenshots shared online.
Do not send it by chat or email, and never give it to anyone who asks for it.
Use the generator only on devices you trust and over HTTPS.
If you suspect exposure, disable 2FA on the account and set it up again to receive a new key.
Authenticator Apps vs SMS Codes
Both methods deliver a one-time code, but they travel very differently. SMS codes are sent through the mobile network to your phone number. Authenticator codes are calculated on your device from a secret key and the clock, so nothing is transmitted at login.
Weaknesses of SMS
Phone numbers can be hijacked through SIM swapping, messages can be intercepted in some situations, and codes are useless if you have no signal. Attackers also trick users into reading codes aloud over the phone.
Strengths of authenticator codes
They work offline and while travelling.
They are not tied to a phone number that can be transferred.
They follow an open standard supported by many apps and tools.
Even so, SMS is far better than no second factor at all. For maximum protection, hardware security keys resist phishing better than either option. Read more in Phishing and 2FA.
SHA-1, SHA-256 and SHA-512 in TOTP
TOTP relies on HMAC, which combines a hash function with your secret key. The original RFC 6238 examples use SHA-1, and it remains the default for almost every service. The standard also allows SHA-256 and SHA-512.
Is SHA-1 unsafe here?
SHA-1 has known weaknesses for digital signatures and certificates, but those attacks target collisions. HMAC-SHA-1 does not depend on collision resistance in the same way, and the short lifetime of each code limits any practical risk.
Which should you choose?
Use the algorithm that the service specifies. If the otpauth link or setup screen lists SHA-256 or SHA-512, select the same one in the generator. If nothing is stated, use SHA-1, 6 digits and 30 seconds. Some authenticator apps ignore algorithm settings and always use SHA-1, so services that need broad compatibility stick with it.
HOTP vs TOTP: What Is the Difference?
HOTP (RFC 4226) and TOTP (RFC 6238) are close relatives. Both use HMAC and dynamic truncation. The difference lies in the moving factor that changes the code.
HOTP
HOTP uses a counter that increases every time a code is requested or used. The code stays valid until it is consumed, which is convenient for hardware tokens with a button, but the device and the server can drift out of step if the button is pressed many times.
TOTP
TOTP replaces the counter with the current time divided by a time step. Codes expire automatically, which narrows the window for attackers and removes the need to track a counter. It is the format used by nearly all authenticator apps.
In short, HOTP is event-based and TOTP is time-based. This website generates TOTP codes.
Why Your 2FA Code Is Not Working
When a correct-looking code is rejected, the cause is almost always one of a few simple problems. Work through this checklist in order.
Clock drift. TOTP depends on accurate time. Turn on automatic date and time on your device, and make sure the time zone is correct. A difference of even a minute can break codes.
Typing the key wrongly. Base32 uses only the letters A–Z and digits 2–7. Confusing the letter O with zero, or I and L with one, creates a different key. Characters 0, 1, 8 and 9 never appear in a valid key.
Wrong settings. Check the digit count, period and algorithm. Most services use 6 digits, 30 seconds and SHA-1.
Expired code. Enter the code before the countdown ends, or wait for the next one.
Wrong account. If you saved several keys, make sure you are using the one for this account.
Setup was changed. If you reset 2FA on the service, the old key no longer works. Use the new key.
Backup codes are a list of single-use codes that most services give you when you enable 2FA. Each one works once in place of a normal code, which makes them your safety net if you lose your phone or cannot access your authenticator.
How to handle them
Save them immediately when they are shown, because many services display them only once.
Keep them offline, for example printed and stored in a safe place, or inside an encrypted password manager.
Do not store them in the same place as your password if that location is easy to compromise.
Regenerate the list if you suspect anyone has seen it, since a new list invalidates the old one.
The menu names differ between services, but the process is nearly identical everywhere.
Sign in and open the account or security settings page.
Find an option called Two-Factor Authentication, Two-Step Verification or Multi-Factor Authentication.
Choose the authenticator app method rather than SMS when both are offered.
When the QR code appears, also choose the option to show the text key and copy it to a secure place.
Scan the QR code with your authenticator app, or enter the text key manually.
Type the six-digit code the app shows to confirm that setup worked.
Save the backup codes the service provides.
Once enabled, you will be asked for a fresh code each time you sign in on a new device. Keep your key and backup codes safe, as explained in Backup Codes and Account Recovery Explained.
10 Best Practices for Staying Safe with 2FA
Enable 2FA on your email first, since it can reset every other account.
Prefer authenticator codes or hardware keys over SMS.
Use a unique, strong password for every account.
Store secret keys and backup codes in a password manager or offline.
Never share a code with anyone, including people claiming to be from a service.
Check the web address before entering a code to avoid fake login pages.
Keep your device clock set to automatic time.
Update your phone and browser to receive security fixes.
Review the devices and sessions linked to your accounts regularly.
Replace your 2FA setup immediately if a device is lost or a key is exposed.
Good habits matter as much as the technology. For a closer look at how attackers target codes, read Phishing and 2FA.
Phishing and 2FA: How Attackers Try to Bypass Codes
2FA stops most automated attacks, so criminals adapt by tricking people instead. A common method is a fake login page that looks identical to the real one. You type your password and your current code, and the attacker immediately uses both on the genuine site before the code expires.
Other tricks
Messages claiming your account is at risk and asking you to read out a code
Repeated push notifications meant to wear you down until you approve one
Fake support callers who ask for codes to "verify" you
How to defend yourself
A real service will never ask you to tell them a one-time code. Always type addresses yourself or use saved bookmarks, check the domain carefully, and treat any urgent request as suspicious. Hardware security keys add the strongest protection because they only respond to the real website.
Implementing RFC 6238 TOTP: A Developer Guide
Building a TOTP generator takes only a few dozen lines of code. These are the pieces you need.
Components
Base32 decoder to turn the secret key text into bytes.
Counter equal to floor(Unix time / period), encoded as an 8-byte big-endian integer.
HMAC using SHA-1, SHA-256 or SHA-512 with the key bytes. Browsers provide this through crypto.subtle.
Dynamic truncation: take the low four bits of the last byte as an offset, read four bytes from that offset, clear the top bit and keep the result as a 31-bit integer.
Modulo by 10 to the power of the digit count, padded with leading zeros.
Practical advice
When verifying codes on a server, accept one step before and after the current one to tolerate clock drift, and reject any code that was already used. Always compare in constant time and rate-limit attempts. Web Crypto only works in secure contexts, so serve your pages over HTTPS.