TOTP Code Generator
Generate time-based one-time passwords for two-factor login without an authenticator app — paste your account's secret key, match its settings, and use the code before the timer ends. Nothing is uploaded; codes are computed on this page.
| Algorithm | Time | Expected | Got | Result |
|---|
How to use
- Copy the secret key from your account security settings (it is usually shown as a base32 code next to the QR code).
- Paste it above and match the algorithm, digits and period shown by your service (almost always SHA-1, 6 digits, 30 seconds).
- Use the current code before the timer runs out — it refreshes automatically.
Note: Your secret never leaves this page — codes are computed locally in your browser and are cleared when you close the tab. TOTP depends on your device clock being correct; if codes are rejected, enable automatic date and time on your device. SHA-512 is not offered; SHA-1 is the standard used by Google Authenticator and most apps. The self-test button checks the generator against the official RFC 6238 test vectors.
Good to know
- Most services use SHA-1, 6 digits, 30 seconds — change these only if your service says so.
- Use the code quickly; it changes when the timer ends.
- Your secret key never leaves this page, but keep a backup copy somewhere safe in case you lose this tab.
Frequently Asked Questions (FAQ)
What is TOTP?
Time-based one-time passwords are short codes that change every 30 seconds and are used for two-factor authentication (2FA).
What do I need to generate a code?
Your base32 secret key from the service. Match the algorithm, digit count and period to what your service uses - most use SHA-1, 6 digits and 30 seconds.
Why is my code being rejected?
TOTP depends on your device clock being correct, so enable automatic date and time on your device. Also check that the algorithm, digits and period match your service.
Is my secret key safe on this page?
Yes. Codes are computed fully offline in your browser and the secret is never uploaded or stored.
Can I check that the generator is accurate?
Yes. The self-test button checks the generator against the official RFC 6238 test vectors. SHA-1 is the standard used by most apps; SHA-256 is also offered, but not SHA-512.