Is it safe to paste my secret here?

Yes, everything runs in the browser. No data goes to our server, no logging, no tracking of secrets. You can verify by disconnecting from the network before using the tool; it will still work.

Why does the code change every 30 seconds?

The standard TOTP "period" is 30 seconds. That gives an attacker who steals one code at most 30 seconds to use it; since servers accept a small window (±1 code), the practical lifetime is up to 90 s. Shorter periods make the system safer but more sensitive to clock drift.

What if my code doesn’t work?

Usually the device clock is off. TOTP requires client and server clocks to agree within 30–60 seconds. Turn on automatic time sync (NTP) in your OS settings; that usually solves it.

Are 6 digits secure enough?

For single-use within 30 seconds, yes. 10^6 = 1 million possibilities combined with rate limiting and lockouts make guessing impossible in practice. The standard also supports 7 and 8 digits for special cases, but 6 balances security and usability.

TOTP / 2FA Code Generator (Base32)

How it works

Paste the secret key (Base32) from a two-factor service and the same six-digit one-time code (TOTP) an authenticator app would show is generated, refreshed every 30 seconds. Handy for testing or as a backup. The calculation (HMAC-SHA1) happens locally in your browser, and the key is never sent anywhere.

About this tool

The TOTP tool generates and verifies one-time codes for two-factor authentication, the same kind of codes Google Authenticator, Authy and 1Password produce. The standard is RFC 6238 and relies on a shared secret and the current time. It lets you paste a base32 secret and see the current 6-digit codes directly, generate QR codes for easy setup in a mobile app, and test that your code matches what the server would see. Useful when building a login system, migrating 2FA keys, or checking that your devices’ clocks are in sync. Everything runs in the browser; the secret never leaves your machine.

How to use it

Paste or generate a base32 secret.
Watch the current 6-digit code refresh every 30 seconds.
Scan the QR code with your authenticator app for easy setup.
Verify a code by typing it and clicking "Check".

Examples

Base32 secret

InputJBSWY3DPEHPK3PXP

Output

Code now: 492 039
Expires in: 12 seconds

otpauth URL for QR

Inputissuer=Verktoy, account=alice@example.com

Outputotpauth://totp/Verktoy:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Verktoy&digits=6&period=30

This URL is encoded as a QR and scanned by the mobile app. issuer and account appear as the "account name" in the app.

Common use cases

Build 2FA login in your own applications.
Migrate 2FA keys between authenticator apps.
Test that server and client clocks are close enough for codes to validate.
Learn how the TOTP algorithm actually works.
Keep a backup code generator on a secondary device.

Frequently asked questions

Is it safe to paste my secret here?: Yes, everything runs in the browser. No data goes to our server, no logging, no tracking of secrets. You can verify by disconnecting from the network before using the tool; it will still work.
Why does the code change every 30 seconds?: The standard TOTP "period" is 30 seconds. That gives an attacker who steals one code at most 30 seconds to use it; since servers accept a small window (±1 code), the practical lifetime is up to 90 s. Shorter periods make the system safer but more sensitive to clock drift.
What if my code doesn’t work?: Usually the device clock is off. TOTP requires client and server clocks to agree within 30–60 seconds. Turn on automatic time sync (NTP) in your OS settings; that usually solves it.
Are 6 digits secure enough?: For single-use within 30 seconds, yes. 10^6 = 1 million possibilities combined with rate limiting and lockouts make guessing impossible in practice. The standard also supports 7 and 8 digits for special cases, but 6 balances security and usability.

Technical background

TOTP (Time-based One-Time Password, RFC 6238) extends HOTP (RFC 4226). The formula is: TOTP = HOTP(secret, floor(current_unix_time / period)). HOTP takes HMAC-SHA-1 of the secret and counter (time / period), extracts 4 bytes at a dynamic offset in the hash, modulo 10^digits, and returns the code. Defaults: period 30 s, 6 digits, hash SHA-1 (RFC 6238 also allows SHA-256/SHA-512, but SHA-1 dominates for compatibility). The secret is often shared as base32 because it is case-insensitive and easy to read out loud. The otpauth:// URL is the de-facto standard for QR exchange and is supported by every major authenticator app. For a secure implementation: use at least a 160-bit (20-byte) secret, accept ±1 period for clock drift, disallow reuse of the same code within its period to prevent replay, and require re-enrolment on device change rather than syncing the secret across devices.