How to use TOTP / 2FA Code Generator
The TOTP / 2FA Code Generator produces live six-digit time-based one-time passwords from a Base32 secret key, with a real-time countdown matching the 30-second window used by Google Authenticator, Authy, and all RFC 6238-compliant authenticator apps. Use it to test 2FA integration flows, recover codes during development, or verify that your server-side TOTP validation is working correctly. The secret never leaves your browser.
- Obtain the Base32 secret from your authentication setup — typically the string shown below the QR code during 2FA enrollment.
- Paste the Base32 secret into the Secret field (spaces and lowercase letters are accepted and normalised automatically).
- The current 6-digit TOTP code appears immediately with a countdown bar showing how many seconds remain in the current 30-second window.
- The next code is also shown so you can hand it to a login form before the current window expires.
- Optionally change the algorithm (SHA-1 default, SHA-256, SHA-512), time step (default 30 s), or digit count (default 6) to match non-standard 2FA configurations.
Your data never leaves your device — 100% private processing.
How TOTP works (RFC 6238)
TOTP (Time-Based One-Time Password) is built on HOTP (HMAC-Based OTP, RFC 4226). The current Unix timestamp is divided by the time step (usually 30 seconds) and floor-rounded to produce a counter value T. An HMAC-SHA1 (or SHA-256/512) digest is computed from the shared secret key and T. A 4-byte dynamic truncation extracts a 31-bit integer from the digest, and the last 6 (or 8) digits modulo 10^6 become the OTP. Because both the client and server derive the same T from the current time, they independently generate identical codes without any network communication — provided their clocks are synchronised within one time step.
| Property | TOTP (RFC 6238) | HOTP (RFC 4226) |
|---|---|---|
| Counter source | Current Unix time ÷ time step | Incrementing counter stored server-side |
| Code validity | 30 seconds (one window) | Valid until used (synchronisation needed) |
| Clock dependency | Yes — client and server must agree on time | No |
| Replay resistance | High — code expires quickly | Lower — codes valid until consumed |
| Common use | Authenticator apps (Google Authenticator) | Hardware tokens (YubiKey OTP mode) |
TOTP security considerations
TOTP secrets are high-value credentials equivalent to a password — if an attacker obtains the Base32 secret, they can generate valid codes indefinitely. Secrets should be stored encrypted at rest (never in plain text), transmitted only over TLS, and ideally displayed to the user exactly once during enrollment via a QR code. Servers should enforce a one-time-use policy (reject a code that was already accepted in the same window) and allow a clock skew tolerance of one time step in each direction to handle minor client clock drift. TOTP does not protect against real-time phishing (attacker-in-the-middle relaying the code immediately) — WebAuthn/FIDO2 passkeys provide phishing-resistant authentication.
Worked examples
Generate a 2FA code
Inputs: Base32 secret JBSWY3DPEHPK3PXP
Result: live 6-digit code with a 30-second countdown
Window length
Inputs: default time step
Result: a new code every 30 seconds
Custom configuration
Inputs: SHA-256 · 8 digits · 60 s step
Result: 8-digit code on a 60-second window
Glossary
- TOTP
- Time-Based One-Time Password — a 6-digit code derived from a shared secret and the current time, valid for 30 seconds.
- HOTP
- HMAC-Based One-Time Password — the counter-based predecessor to TOTP defined in RFC 4226.
- Base32
- An encoding using the 32-character alphabet A-Z and 2-7, commonly used to represent TOTP secrets in QR codes.
- RFC 6238
- The IETF standard defining the TOTP algorithm, building on HOTP (RFC 4226) by substituting a time-derived counter.
- Clock skew
- A difference between the client and server clocks; TOTP implementations typically accept codes from ±1 adjacent time window to compensate.
Related reading
Frequently Asked Questions
Why use TOTP / 2FA Code Generator?
- Generate live 6-digit TOTP codes from any Base32 secret to test 2FA login flows
- Display both the current code and the next code with a countdown to the window end
- Support non-standard configurations: SHA-256/512 algorithms, custom time steps, 8-digit codes
- Verify server-side TOTP validation logic by comparing output with your own implementation
Common use cases
- Test a 2FA login form during development without needing a physical authenticator app
- Recover access to a development account when the registered authenticator app is unavailable
- Verify that your backend accepts codes from the adjacent time window to handle clock skew
- Test a custom TOTP configuration with a 60-second time step and SHA-256 algorithm
- Generate codes to test a rate-limiting implementation that blocks after three wrong attempts
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Developer Tools
Bcrypt Hash Generator & Checker
Generate bcrypt password hashes and verify a password against a hash online. Adjustable cost factor. Free, private bcrypt tool in your browser.
JSON Schema Validator
Validate JSON data against a JSON Schema online. Get clear, path-based error messages for every violation. Free, private JSON Schema validator.
User Agent Parser
Parse any user-agent string to identify the browser, engine, operating system, and device. Detects your own UA too. Free and private.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser. Free, private, and secure for quick checks.
UUID Generator
Generate random UUID v4, timestamp-based UUID v1, and ULID identifiers. Bulk-generate up to 100 at once and copy them instantly — free and private.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Explore all Developer Tools.