TOTP / 2FA Code Generator — Authenticator Online
Generate a two-factor authentication code from your secret, entirely on your device. Paste a base32 secret or an otpauth:// link and the current code appears, with a countdown to the next one.
Settings are read from the otpauth link. Clear the field to choose them yourself.
Paste a secret to begin.
What this tool does
Two-factor authentication apps generate a fresh six-digit code every 30 seconds, and this page does the same computation from the same secret. It is useful when your phone is not to hand, when you are setting up a new device and want to confirm the secret is correct, or when you simply want to understand what the app is doing. Everything runs in your browser: the secret is read from the box, the code is computed with plain JavaScript, and nothing — secret, code or timing — leaves the page.
How TOTP works
| Step | What happens |
|---|---|
| 1. Time step | The current time is divided by the period (30 s) to get a counter |
| 2. HMAC | The counter is HMAC-hashed with your secret as the key |
| 3. Truncate | A slice of the hash is reduced to a number (RFC 4226 dynamic truncation) |
| 4. Modulo | The number mod 10⁶ gives the six-digit code |
Both your app and the server run the same four steps with the same secret and the same clock, so the codes agree with no message passing. That is why a wrong system clock, rather than a wrong secret, is the usual reason a code fails.
Base32 secrets and otpauth links
Authenticator secrets are written in base32 — the alphabet A–Z and 2–7, so the digits 0, 1, 8 and 9
never appear and the string is easy to read aloud without ambiguity. Most services also encode the
secret, the issuer and the account into an otpauth://totp/… link inside the setup QR
code; paste that link here and the settings (digits, period, algorithm) are read from it
automatically.
Security notes
A TOTP secret is a shared credential: anyone who has it can generate your codes, so treat it like a password. This page is built so you never have to trust it with the secret — it is read locally, used for one sum per 30 seconds, and never stored or transmitted. Prefer it on your own device, on a connection you trust, and close the tab when you are done.
Frequently asked questions
Which algorithm, period and digit count does this use?
The defaults are the ones nearly every service uses: HMAC-SHA-1, a 30-second period and six digits. The page lets you change the algorithm, period and digits for services that deviate. If the code does not match, check those three settings against the service’s setup page before suspecting the secret — a 60-second period with a 30-second assumption is off by half a window.
What is the time window and how much clock drift is tolerated?
TOTP computes a code from the current 30-second counter, and verifiers normally accept the previous and next window as well, which gives roughly ±30 seconds of tolerance. A device clock that is minutes out will fail even with the right secret. Phones usually synchronise automatically; a laptop that has been asleep for days is the usual culprit.
Is it safe to type my secret here?
The secret stays in the page and is never stored or sent, so the network risk is nil. The remaining risks are local: a shared or compromised machine, a screen recorder, or a browser extension with page access. For a high-value account, use the dedicated authenticator app on a device you control rather than a web page on a machine you do not.
What is a TOTP code?
A TOTP (time-based one-time password) is the six-digit code your authenticator app shows for two-factor login. It is computed from a shared secret and the current time, so it changes every 30 seconds. Both sides — your app and the server — do the same sum from the same secret and clock, and the two numbers agree without anything being transmitted.
Is it safe to type my secret into a website?
Only into a page that computes the code locally and never sends the secret anywhere — which is what this page does. All the arithmetic runs in your browser with JavaScript; the secret is never put in a URL, a request or a cookie, and closing the tab discards it. If you are on a shared computer, generate the code you need and close the tab.
Where do I find my secret?
When you set up two-factor authentication on a service, it shows a QR code and usually a "can't scan the code?" link that reveals a base32 string such as JBSWY3DPEHPK3PXP. That string is the secret. You can paste either the base32 secret or the full otpauth:// link from the QR code.
Why does the code not match my app?
Almost always because the device clock is off, or because the secret was mistyped. TOTP depends on the current time, so a clock that is a minute out produces a different code. Check that your system time is set automatically, and that you copied the whole secret with no missing characters.
What is the difference between TOTP and HOTP?
TOTP changes with the clock and needs no counter; HOTP changes with a counter that increments on every use. TOTP is what nearly every service uses today because it needs no shared counter to stay in step; this tool computes TOTP, and shows the HOTP counter under the hood for reference.
Does this store my secret?
No. Nothing is saved — not in localStorage, not in a cookie, not on a server. The value lives only in the text box until you close or reload the page.
Go deeper
Longer explanations of the problems this tool solves:
Sources
- RFC 6238, TOTP: Time-Based One-Time Password Algorithm.
- RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm.
- RFC 4648, The Base16, Base32, and Base64 Data Encodings.
Everything runs in your browser — nothing you type is uploaded.