Generate TOTP Codes Online Free
🔑 Generate or Verify a TOTP Code
Paste an existing secret to see its live code, or generate a brand-new one to set up and test 2FA. Nothing leaves your device.
🔑 Secret Key
Paste the secret your service gave you (from its 2FA setup page), or click "New" to generate a random one for testing.
📷 Scan a QR Code (optional)
⚙️ Options
⚠️ Google Authenticator and Microsoft Authenticator only support SHA-1, 6 digits, 30s. Only change these if your service specifically issued different settings.
EXAMPLE SERVICE
you@example.com
30s until next code
Secret (Base32)
••••••••••••••••
Scan into an authenticator app
Quick answer: Paste a Base32 secret (or click "New" to generate one), and a live 6-digit TOTP code appears immediately, refreshing every 30 seconds. You can also scan an existing QR code image to auto-fill the secret, issuer and account. Everything - HMAC hashing, Base32 decoding, and code generation - runs locally using the browser's Web Crypto API. Nothing is uploaded, logged, or stored. This tool is for testing, debugging, and recovery - store real, long-term 2FA secrets in a dedicated authenticator app instead.
- Cost: Free, unlimited codes, no signup.
- Where it runs: 100% in your browser using the Web Crypto API — no upload, no server.
- Standard: RFC 6238 (TOTP), built on RFC 4226 (HOTP).
- Configurable: SHA-1 / SHA-256 / SHA-512, 6 or 8 digits, 30s or 60s step.
- QR support: Scan an existing otpauth QR code, or generate one for your secret.
- Persistence: Nothing is saved — closing the tab clears everything.
🧪 Built for Testing & Recovery: This tool is meant for developers testing 2FA flows, QA engineers automating login tests, and one-off account recovery — not as a long-term home for your real 2FA secrets.
🕒 Clock Accuracy Matters: TOTP codes depend on the current time. If your device's clock is off by more than about 30 seconds, generated codes won't match the server's.
✅ Privacy: Your secret and code are computed locally with the Web Crypto API — never uploaded, transmitted, or stored anywhere.
✅ 100% Private: Every code is generated locally in your browser using the Web Crypto API. No secret, code, or QR image is ever uploaded to a server.
Note: Your secret and settings are cleared once your session ends or you reload the page.
How to Generate a TOTP / 2FA Code
Enter or Generate a Secret
Paste an existing Base32 secret, or click "New" to create one.
Choose Algorithm & Digits
Adjust these only if your service needs non-default values.
Read the Live Code
Watch the 6-digit code and countdown ring refresh automatically.
Copy or Scan the QR
Copy the code, or scan the QR into an authenticator app.
🔒 Your Secret Never Leaves Your Device
Every TOTP code is computed with the browser's built-in Web Crypto API — the same audited cryptography engine used by the browser itself. There is no upload step, no server-side processing, and no network request that contains your secret.
Common Uses for a TOTP / 2FA Code Generator
QA & Test Automation
Compute the current code for a test account's 2FA secret so Playwright, Cypress, or Selenium scripts can complete login flows without a phone in the loop.
Developers Building 2FA
Verify a server-generated secret produces the expected code while building or debugging a TOTP integration.
Lost or New Device Recovery
Get a one-off code when you can't reach your usual authenticator app, using a backed-up secret.
Learning How TOTP Works
See the secret, algorithm, and time step come together into a live code to understand RFC 6238 hands-on.
Verifying a Secret Before Saving
Confirm a secret works correctly before committing it to a password manager or authenticator app long-term.
Reading an Existing QR Code
Extract the secret from a QR code image you already have, without needing a phone camera.
Why Use This TOTP / 2FA Code Generator?
- Fully Client-Side: The Web Crypto API computes every code in your browser — no upload.
- Standard-Compliant: Implements RFC 6238 (TOTP) on top of RFC 4226 (HOTP) HMAC truncation.
- QR In and Out: Scan an existing QR code, or generate one for a new secret.
- Configurable: SHA-1, SHA-256, or SHA-512; 6 or 8 digits; 30s or 60s step.
- Live Countdown: A visual ring shows exactly how long the current code is valid.
- One-Click Copy: Copy the code or the secret instantly.
- Nothing Saved: No local storage, no cookies — closing the tab clears everything.
- 100% Free & Private: No account, no tracking, no server storing your secret.
TOTP / 2FA Code Generator – Complete Guide
Two-factor authentication is only as convenient as the tool that gives you the second factor when you need it. This generator computes a real, RFC 6238-compliant TOTP code from any Base32 secret in a few seconds, for testing, debugging, or getting back into an account when your usual authenticator app isn't handy.
What Is TOTP (Time-based One-Time Password)?
TOTP, defined in RFC 6238, is the algorithm behind the six-digit codes shown by apps like Google Authenticator and Microsoft Authenticator. Both the server and the app share the same secret key when 2FA is first set up. From then on, each side independently combines that secret with the current time to compute the same code, without either side needing to talk to the other again.
How This Generator Actually Works
The secret you enter is decoded from Base32 into raw bytes. The current Unix time is divided by the time step (30 seconds by default) and floored to get a moving counter, which is packed into an 8-byte big-endian buffer. That buffer is signed with the secret using HMAC via crypto.subtle.sign(), with the algorithm you selected (SHA-1, SHA-256, or SHA-512). The last 4 bits of the resulting HMAC pick an offset, four bytes are read from that offset and masked, and the result is reduced modulo 10 to the power of your chosen digit count - producing the code you see. This is the same dynamic-truncation process defined in RFC 4226 for HOTP, with TOTP simply supplying a time-based counter instead of an incrementing one. The countdown ring recalculates the seconds remaining in the current time step every quarter-second, and a new code is computed the instant the step rolls over.
TOTP vs HOTP vs SMS OTP
| Aspect | TOTP (this tool) | HOTP | SMS OTP |
|---|---|---|---|
| Counter source | Current time (RFC 6238) | Incrementing counter (RFC 4226) | Server-generated, sent per request |
| Needs network at login? | No | No | Yes (to receive the SMS) |
| Common weakness | Clock drift between devices | Counter desync if codes are skipped | SIM swap, SMS interception |
Supported Algorithms & Compatibility
| Setting | Compatible With |
|---|---|
| SHA-1, 6 digits, 30s | Google Authenticator, Microsoft Authenticator, Authy, most services (the de-facto default) |
| SHA-256 / SHA-512 | Only services that explicitly issue a secret with a non-default algorithm parameter |
| 8 digits | Some enterprise / banking systems that request longer codes |
Security and Privacy Considerations
- No Data Upload: Your secret, issuer, and account label never leave your device.
- No Server Processing: HMAC signing runs entirely through the browser's native Web Crypto API.
- No Storage: Nothing is written to local storage, cookies, or a server — a refresh clears it all.
- Not a Replacement for a Password Manager: Use a dedicated authenticator app or password manager for secrets you rely on long-term.
Browser Compatibility and Technical Requirements
This TOTP Generator works in modern browsers that support:
- Web Crypto API (
crypto.subtle): For HMAC-SHA1/256/512 signing. - Canvas / File API: To read an uploaded QR code image for scanning.
- Clipboard API: For one-click copying of the code and secret.
Supported Browsers:
- ✅ Chrome/Edge 60+
- ✅ Firefox 57+
- ✅ Safari 11+
- ✅ Mobile Chrome (Android), Mobile Safari (iOS)
Troubleshooting Common Issues
Explanation: This usually means the algorithm, digit length, or time step don't match, or your device clock has drifted. Solution: Confirm all three settings match what your service issued, and check your system clock is set to automatic/network time.
Explanation: The uploaded image either isn't a QR code, is too blurry to read, or encodes something other than an otpauth:// URI. Solution: Upload a clearer, higher-resolution screenshot, or type the secret in manually instead.
Explanation: Base32 secrets only use the letters A-Z and digits 2-7. Solution: Remove any spaces, dashes, or lowercase letters that may have been introduced when copying the secret, and try again.
Explanation: This page is a manual, visual tool. Solution: For test automation (e.g., Playwright or Cypress), implement the same RFC 6238 algorithm directly in your test code using a TOTP library, and use this page to sanity-check that the codes it produces match.
Frequently Asked Technical Questions
Question 1: What cryptographic primitive actually generates the code?
Answer: An HMAC (Hash-based Message Authentication Code) computed over an 8-byte time counter using your chosen hash algorithm, via the browser's native crypto.subtle.sign() — the same primitive specified in RFC 4226 and RFC 6238.
Question 2: How is the 6 or 8-digit code derived from the HMAC output?
Answer: Using "dynamic truncation": the last 4 bits of the HMAC pick a starting byte offset, four bytes from that offset are read and masked to a positive 31-bit integer, and that number is reduced modulo 10^digits.
Question 3: How does the tool read a secret from a QR code image?
Answer: The uploaded image is drawn to an off-screen canvas, decoded into pixel data, and scanned for a QR pattern client-side; if found, the embedded otpauth://totp/... URI is parsed to extract the secret, issuer, algorithm, digits, and period.
Question 4: Why does the countdown ring sometimes jump early?
Answer: The ring is driven by your device's local clock, recalculated every 250ms from the true Unix time step — so it stays accurate even if the browser tab was inactive and JavaScript timers were throttled in the background.
Question 5: Does this tool need an account, server, or API key?
Answer: No. The Web Crypto API is built into every modern browser — you never need an account, backend, or API key to use this tool.
Glossary of Terms
- TOTP
- Time-based One-Time Password - a short numeric code derived from a shared secret and the current time, defined in RFC 6238.
- HOTP
- HMAC-based One-Time Password - the counter-based ancestor of TOTP, defined in RFC 4226, where a code is tied to an incrementing counter instead of time.
- Base32 Secret
- The shared secret key, encoded in Base32 text, that both the server and the authenticator app use to compute matching one-time codes.
- otpauth URI
- A standard URI format (otpauth://totp/...) that encodes a secret, issuer, algorithm, digits and period, typically embedded in a QR code for authenticator apps to scan.
- Authenticator App
- An app such as Google Authenticator or Microsoft Authenticator that stores a TOTP secret and displays the current one-time code for logging in.
Frequently Asked Questions
Yes, completely free with no signup and no limit on how many codes or secrets you generate.
No. Every code is computed locally using the browser's built-in Web Crypto API. Your secret is never transmitted over the network or stored anywhere.
TOTP (Time-based One-Time Password) is an algorithm defined in RFC 6238 that combines a shared secret with the current time to produce a short numeric code that changes every 30 seconds, used as a second factor for logins.
It is fine for testing, debugging, or one-off recovery, but a browser tab is not durable storage for a real second factor. For everyday accounts, store the secret in a dedicated authenticator app or password manager instead.
Both use the same HMAC-based algorithm, but TOTP derives its counter from the current time (RFC 6238) so the code changes every fixed interval, while HOTP uses a counter that increments each time a code is generated (RFC 4226).
Use the default SHA-1, 6 digits, 30-second period unless your service explicitly issued a secret with different settings - that default is what Google Authenticator, Microsoft Authenticator and most services expect.
This almost always means a mismatched algorithm, digit length, or time step, or that your device's clock has drifted - TOTP codes are only valid if both sides agree on the current time within one step.
Yes. Upload a screenshot or photo of the QR code and the tool reads the embedded otpauth:// URI to fill in the secret, issuer, algorithm, digits and period automatically.
It's gone. Nothing is saved to local storage, cookies, or a server, so refreshing or closing the page clears the secret and code permanently.
Final Thoughts
Whether you're wiring up 2FA in a new app, automating a login flow in a test suite, or just need one code because your phone is across the room, this generator produces a real, standards-compliant TOTP code without ever sending your secret anywhere. Paste a secret above and watch the code refresh live.
Enter your secret above and generate your first live TOTP code!