TOTP Generator & Verifier
Generate time-based one-time passwords (RFC 6238) from any Base32 secret, and verify a code against it. Everything runs locally via the Web Crypto API — your secret never leaves your browser.
What is TOTP?
TOTP (Time-based One-Time Password) is the algorithm behind most "authenticator app" two-factor codes — the 6-digit numbers generated by Google Authenticator, Authy, or 1Password. Defined in RFC 6238, it derives a short-lived code from a shared secret and the current Unix time, using HMAC-SHA1, SHA-256 or SHA-512.
How to use this tool
- Paste a Base32 secret (from a "can't scan the QR code?" setup screen), or click Random to generate one for testing.
- The current code, a live countdown, and a scannable QR code (otpauth:// URI) update automatically.
- Use Verify a code to check whether a 6/8-digit code matches the secret right now (checked against the current and adjacent time windows to allow for clock drift).
Frequently Asked Questions
Is my secret sent anywhere?
No. All TOTP math runs locally using the browser's Web Crypto API. Nothing is uploaded — open your Network tab to verify.
Why doesn't my code match my authenticator app?
Check that the algorithm, digit count and period match your app's defaults (SHA-1, 6 digits, 30 seconds is the near-universal default). Also make sure your system clock is accurate — TOTP is time-sensitive.
Should I use this with a real account's secret?
This tool is for testing, debugging integrations, and learning how TOTP works. Treat any real 2FA secret as sensitive — this page processes it locally and never transmits it, but always be cautious pasting production secrets into any browser tool.