Free · Private · Client-side

TOTP Code Generator

Enter or create a Base32 secret to calculate the current 6-digit TOTP code, live in your browser. Compatible with Google Authenticator, Authy, and other 2FA apps.

Generated values never leave this device.

20 bytes (160 bits) encoded as Base32. Store securely - this is your master secret.

TOTP (RFC 6238) derives a 6-digit code from the secret and the current 30-second time window — codes expire and regenerate every 30 seconds, and both sides compute them locally from the shared secret.

Current TOTP Code

Refreshes in 30s
••••••

Need a new secret?

Generate a fresh Base32 TOTP setup key with the TOTP Secret Generator →

Want a QR code?

Build a scannable otpauth QR setup for your authenticator app →

Setup in Authenticator App

Paste into an authenticator that accepts otpauth URLs, or use the QR setup tool to scan it. The URL contains your secret — share it only over secure channels.

Setup Instructions

Google Authenticator

  1. Open Google Authenticator app
  2. Tap the + icon
  3. Select "Enter a setup key"
  4. Paste the Base32 secret above
  5. Verify the 6-digit code matches

Authy

  1. Open Authy app
  2. Tap the + icon
  3. Choose manual entry
  4. Paste the Base32 secret above
  5. Enter account details if prompted

Manual Setup

  1. Choose "Enter a setup key" option
  2. Copy the Base32 secret above
  3. Paste into your authenticator
  4. Set time-based (TOTP)
  5. Use 6 digits, 30-second interval

Alternative Apps

  • Microsoft Authenticator
  • 1Password
  • Bitwarden
  • LastPass Authenticator
  • FreeOTP

Security Best Practices

  • Backup your secret - Store the Base32 secret in a secure location
  • Use strong secrets - Generate random 160-bit (20-byte) secrets
  • Secure transmission - Share QR codes/secrets over secure channels only
  • Multiple devices - Consider setting up multiple authenticator devices
  • Recovery codes - Always generate backup/recovery codes for your accounts

Implementation Examples

JavaScript/Node.js
const crypto = require('crypto');

function generateTOTP(secret, window = 30) {
  const counter = Math.floor(Date.now() / 1000 / window);
  const buffer = Buffer.alloc(8);
  buffer.writeUInt32BE(counter, 4);

  const hmac = crypto.createHmac('sha1', Buffer.from(secret, 'base32'));
  hmac.update(buffer);
  const hash = hmac.digest();

  const offset = hash[19] & 0xf;
  const code = (
    ((hash[offset] & 0x7f) << 24) |
    ((hash[offset + 1] & 0xff) << 16) |
    ((hash[offset + 2] & 0xff) << 8) |
    (hash[offset + 3] & 0xff)
  ) % 1000000;

  return code.toString().padStart(6, '0');
}

// Usage
const secret = 'YOUR_BASE32_SECRET';
const code = generateTOTP(secret);
console.log('TOTP Code:', code);
Python
import hmac
import hashlib
import struct
import time
import base64

def generate_totp(secret, window=30):
    # Decode base32 secret
    key = base64.b32decode(secret.upper() + '=' * (-len(secret) % 8))

    # Current time window
    counter = int(time.time() // window)

    # Generate HOTP
    counter_bytes = struct.pack('>Q', counter)
    hmac_digest = hmac.new(key, counter_bytes, hashlib.sha1).digest()

    # Dynamic truncation
    offset = hmac_digest[-1] & 0xf
    code = struct.unpack('>I', hmac_digest[offset:offset+4])[0]
    code = (code & 0x7fffffff) % 1000000

    return f'{code:06d}'

# Usage
secret = 'YOUR_BASE32_SECRET'
code = generate_totp(secret)
print(f'TOTP Code: {code}')

Testing & Validation

Verify codes match between this tool and your authenticator app
Test with a known reference implementation (RFC 6238)
Check time synchronization between devices
iTOTP codes refresh every 30 seconds
iAllow ±1 time window for network delays and clock skew