TOTP (One-Time Password) Generator
Generate the same 6-digit one-time password (RFC 6238) as Google Authenticator and similar apps from a Base32 TOTP secret, entirely in your browser. Your secret is never transmitted.
About the TOTP Algorithm
TOTP (Time-based One-Time Password) is a time-based one-time password algorithm defined in RFC 6238. It converts a shared secret and the current time into a counter that advances at fixed intervals, then derives a numeric code using the same dynamic truncation algorithm as HOTP (RFC 4226).
| HMAC algorithm | Choose from SHA-1 (default), SHA-256, or SHA-512 |
|---|---|
| Code length | 6 digits (the same standard length used by Google Authenticator and most major 2FA apps) |
| Refresh interval | A new code is generated every 30 seconds |
What a TOTP code is
A TOTP (Time-based One-Time Password) is the six-digit code, refreshed every thirty seconds, used in two-factor authentication to add a second check on top of your username and password. It is computed from a shared key called the secret, registered in advance, combined with the current time — which is why the server and the authenticator app in your hand arrive at the same code without ever talking to each other. Google Authenticator, Microsoft Authenticator, Authy and the other major apps all follow the same standard, RFC 6238.
Paste the setup key shown beneath the QR code when you enrol in two-factor authentication — the secret, in Base32 — and this tool reproduces the same six-digit code your authenticator app would show, entirely in the browser. Decoding the Base32 secret and computing the HMAC both happen through the Web Crypto API, and nothing is sent to a server. It is useful for re-registering an authenticator app, double-checking a code, or confirming behaviour across several devices.
How to generate a code
- Enter the secret Paste the Base32 setup key issued during two-factor enrolment (for example JBSWY3DPEHPK3PXP) into the secret field.
- Confirm the hash algorithm Most services use SHA-1. If the code does not match, try switching to SHA-256 or SHA-512.
- Read the six-digit code The code for the current moment is computed as you type and shown with a progress bar counting down the seconds remaining.
- Copy it if you need to The copy button places the code on the clipboard. Avoid using it in the last moments before it rolls over.
Tips for getting more out of it
- The secret is the "setup key" string shown below the QR code when you first register two-factor authentication (2FA). If you already registered it in a phone authenticator app, entering the same secret here lets you cross-check the code.
- Some services use a hash algorithm other than SHA-1 (SHA-256 or SHA-512). If the generated code doesn't match your actual app, try switching the algorithm.
- The code refreshes automatically every 30 seconds, with a progress bar showing the time remaining. Be careful copying a code right before it expires, since it may become invalid before it reaches the service you're authenticating with.
- Closing this browser tab permanently discards the secret; nothing is ever saved anywhere. If you want to keep it as a backup, store the secret itself somewhere secure, such as a password manager.
When this generator helps
Checking or migrating an authenticator app
Before you swap devices and re-enrol, you can verify here that the secret you saved is correct — without waiting to find out on the new phone.
Testing logins in a development environment
When adding two-factor authentication to your own service, generate codes from a test account’s secret whenever you need them to exercise the authentication logic.
Verifying a backed-up secret
Confirm quickly that a secret stored in a password manager still works, without opening the authenticator app on your phone.
Tightening account security more broadly
If you also want to revisit the strength of the password itself, the password generator and the memorable passphrase generator are worth a look.
Exploring the hashing behind it
If the HMAC and hash functions underlying TOTP interest you, try the SHA-256 hash calculator to see the building block in isolation.
Terms used with TOTP
- TOTP (Time-based One-Time Password)
- A scheme (RFC 6238) that generates a one-time password from a counter derived from the current time. The code changes automatically at a fixed interval, normally thirty seconds.
- HOTP (HMAC-based One-Time Password)
- The earlier standard (RFC 4226) that TOTP is built on. It uses a counter that advances by one with each use, rather than the clock.
- Secret (shared key)
- The private key held by both the service and your authenticator app. It is issued as a Base32 string during enrolment, and the code is computed from it together with the time.
- Two-factor authentication (2FA)
- A login scheme combining something you know, the password, with something you have, typically an authenticator app on a phone. Even if one is leaked, unauthorised access remains much harder.
- Time step
- The interval at which a TOTP code changes. RFC 6238 sets a default of thirty seconds, and most services and apps use it unchanged.
- Base32
- An encoding that represents a byte sequence using only the 32 characters A–Z and 2–7. TOTP secrets are distributed in this form because it is easy to read and transcribe.
- Dynamic truncation
- The step that takes four bytes from the long HMAC output according to a fixed rule and converts them into a six-digit number. It is defined in RFC 4226 and shared by HOTP and TOTP.
FAQ
Side Note — Why Two-Factor Codes Settled on 6 Digits
OATH (the Initiative for Open Authentication), which drafted the TOTP specification (RFC 6238), simply reused HOTP's (RFC 4226) dynamic truncation algorithm and left the code length up to each implementation. Six digits became the de facto industry standard largely because Google Authenticator adopted that length in its original 2010 implementation, and many other services and libraries followed suit.
Six digits also happens to be a sweet spot. With one million possible combinations (10^6) and a short 30-second validity window, brute-forcing a code becomes practically impossible, while anything longer would be impractical for a human to memorize and type. It's no coincidence that most SMS verification codes are also 6 digits — the industry converged on this length for any "short-lived, disposable numeric code."
TOTP's predecessor, HOTP (RFC 4226, 2005), used a counter that had to be incremented by one every time a code was used. In practice this caused frequent sync problems — users forgetting to press a button, or the counter on the device and server drifting apart. TOTP, standardized in 2011, replaced the counter with the current time, a reference value everyone can agree on, dramatically simplifying operations.