Handitab

TOTP / 2FA Generator

Generate 6-digit TOTP codes from a Base32 secret, the way an authenticator app does, with the secret kept inside your browser.

About TOTP / 2FA Generator

TOTP (time-based one-time password, RFC 6238) is the algorithm behind authenticator apps. It computes an HMAC-SHA-1 of the current 30-second time step with a shared secret, then truncates the result to a 6-digit code. This tool decodes your Base32 secret, runs that calculation with the Web Crypto API every second, and shows the code and the seconds left. It supports only SHA-1, 6 digits, and 30-second steps. The secret does not leave your browser.

Questions about TOTP / 2FA Generator

Why does my code not match the one in my authenticator app?

The usual causes are a wrong device clock, since codes depend on the current time, or a service that uses non-default settings such as SHA-256, 8 digits, or a 60-second period, which this tool does not support.

Where do I find the Base32 secret?

It is the text version of the QR code shown when you set up two-factor authentication, often behind a link for entering the key manually. It is also the secret parameter inside an otpauth:// link.

Runs in your browser. Page last updated .

More security tools

All 10 security tools
API Key / Token GeneratorGenerate random strings for API keys, tokens, and secrets, 1 to 512 characters long, in alphanumeric, hex, or URL-safe Base64 characters.Cipher ToolsEncode or decode text with the classical Caesar, ROT13, Atbash, and Vigenère ciphers, for learning and puzzles rather than for security.Hash GeneratorCalculate the MD5, SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 hashes of any text at once, as one-way digests that cannot be reversed.JWT DecoderDecode a JSON Web Token to read its header, payload, and expiry time, or create an HS256-signed token from a JSON payload and secret.JWT EncoderCreate a signed JSON Web Token from a JSON payload and a secret, using the HS256 algorithm (HMAC with SHA-256) in your browser.Password GeneratorGenerate strong random passwords of 6 to 64 characters in your browser, with a choice of letters, digits, and symbols and an entropy estimate.