TOTP Code Generator (RFC 6238)

How to use this tool

1. Enter your Base32 secret. Paste a Base32 secret or otpauth://totp URI from your 2FA setup page. For a test service, you can also generate a random secret in this browser.
2. Confirm the settings. Most services use SHA-1, 6 digits, and a 30-second period. Change these only if your service explicitly specifies different values; some authenticator apps do not support custom periods.
3. Read the current code. The tool displays your current code, the countdown to the next rotation, and a preview of the next code. You can also verify a pasted code against the current or adjacent time steps.
4. Provision a test account. Enter an issuer and account label to create an otpauth:// URI and QR code locally. These include the secret, so use them only for test or development accounts.

What is TOTP?

TOTP (Time-based One-Time Password) is defined in RFC 6238 and builds on HOTP (RFC 4226). It generates a short numeric code that refreshes every 30 seconds (or configurable period) using a shared Base32 secret and the current UTC time. Authenticator apps like Google Authenticator, Authy, and Microsoft Authenticator implement TOTP.

How TOTP works

The algorithm has three steps. First, the current Unix timestamp is divided by the period (30 seconds) and truncated to produce a counter value T. Second, HMAC-SHA1 (or SHA-256/SHA-512) is computed over the 8-byte big-endian encoding of T, using the decoded Base32 secret as the key. Third, a dynamic truncation step extracts 4 bytes from the HMAC output and reduces them modulo 10⁶ (or 10⁸ for 8-digit codes) to produce the final code.

Provisioning and testing

When you are building a service that supports two-factor authentication, you can generate a random Base32 test secret with the browser's cryptographic random number generator. Add an issuer and account label to create an otpauth://totp/ setup URI and a QR code that authenticator apps can scan. Both encodings include the secret, so use them only for test or development accounts. The secret stays in this browser and is never added to the page URL.

Standard SHA-1, 6-digit, 30-second settings are omitted from the setup URI because those are the usual authenticator defaults. Non-default algorithms, digit counts, and periods are added explicitly. Some authenticator apps ignore custom periods, so check your target app when testing non-standard configurations. A 15-second period is useful for services that specify it, but 30 seconds remains the broadest-compatibility choice.

The verification panel recomputes the entered code for the current time step and, if selected, the neighboring steps. A match one step earlier or later can help identify clock drift; the displayed seconds are an approximate step offset. This is a local diagnostic, not a server login check. A production service should choose a narrow acceptance window and enforce its own replay and rate limits.

Privacy and security

All TOTP computation happens locally in your browser using the native Web Crypto API. Your secret key is never transmitted anywhere. However, your TOTP secret is equivalent to your two-factor authentication. Anyone who has it can generate valid codes. Only enter test or development secrets here, and use a dedicated authenticator app for real accounts.

Finding your Base32 secret

When you enable 2FA on a website, the setup page shows a QR code and usually a "Manual entry key" or "Secret key" link. This key is your Base32-encoded TOTP secret. It consists of uppercase letters A–Z and digits 2–7.

Common TOTP app comparison

Cloud-backup apps trade some security for convenience. A cloud-synced authenticator is easier to restore after a lost phone, but the backup itself becomes a target. For highest security, use a hardware key or an app with no cloud sync.

What happens when clocks drift

TOTP requires the client and server clocks to be closely synchronized. The TOTP standard allows servers to accept codes from the ±1 adjacent time window (i.e., codes valid up to 30 seconds before or after the current window), providing a 90-second acceptance window.

If your clock drifts beyond 90 seconds, valid codes will be rejected. To resync:

• Windows: w32tm /resync in an elevated command prompt.
• macOS: System Settings -> General -> Date & Time -> toggle "Set automatically."
• Mobile: Settings -> General -> Date & Time -> toggle "Set automatically."

TOTP vs. SMS 2FA

TOTP is significantly more resistant to common attacks than SMS-based two-factor authentication:

• SIM-swapping: attackers social-engineer mobile carriers into transferring your phone number to a SIM they control, intercepting all SMS codes. TOTP codes are not delivered via the carrier - they are generated locally - so SIM-swapping has no effect.
• SS7 interception: the telecom signaling protocol has known vulnerabilities that sophisticated attackers can exploit to intercept SMS. TOTP is immune.
• Phishing: both TOTP and SMS codes can be phished in real-time by adversary-in-the-middle attacks. Hardware security keys (FIDO2/WebAuthn) are the only phishing-resistant 2FA option.

Even imperfect TOTP is a major security improvement over SMS 2FA. Enable TOTP wherever it is offered, and reserve hardware keys for your most critical accounts.