OTP Code Generator
Generate live TOTP (Time-based One-Time Password) codes from a Base32 secret, exactly like Google Authenticator or Authy.
Recommended Settings
Pro Tips
- •This generates real, standards-compliant TOTP codes (RFC 6238) - the same algorithm used by Google Authenticator, Authy, and most two-factor authentication systems
- •A fresh random secret is generated on page load - paste in your own Base32 secret (usually shown when setting up 2FA) to generate the matching live code
- •Codes refresh every 30 seconds by default, matching the standard used by virtually all authenticator apps
- •Keep any real 2FA secret private - anyone with it can generate the same codes as your authenticator app, bypassing your two-factor protection
Most Popular
Most services use SHA-1 with 6 digits - only switch algorithm or digit count if your service specifically requires it
When to Use This Tool
Generate live codes for a test account's 2FA secret without needing a phone or authenticator app.
Generate a code from a saved Base32 secret if you've lost access to your authenticator app.
See exactly how a shared secret and the current time combine to produce a one-time code.
Confirm your own TOTP implementation produces the same codes as this standard reference.
How It Works
Decode your Base32 secret into raw bytes
Compute the current 30-second time step and use it as an HMAC counter value
Generate an HMAC of the counter using your secret, then extract a truncated numeric code from the result, exactly as defined in RFC 6238
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Client-side Web Crypto API (HMAC-based TOTP, RFC 6238) for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
Is this compatible with Google Authenticator?
Yes, this implements the same standard TOTP algorithm (RFC 6238) that Google Authenticator, Authy, and virtually every 2FA app uses.
Where do I get a Base32 secret?
When you set up two-factor authentication on a service, it's usually shown as a QR code and also as a plain text 'secret key' you can enter manually - that text is the Base32 secret.
Is my secret sent to a server?
No. All code generation happens locally in your browser using the Web Crypto API - your secret never leaves your device.
Why does my code not match my authenticator app?
Check that your device's clock is accurate, and that you're using the matching algorithm and digit count - most services use SHA-1 with 6 digits by default.