TOTP (Time-based One-Time Password) is a standard (RFC 6238) used by most two-factor authentication apps. It generates a short-lived numeric code from a shared secret and the current time.

Is my secret key stored anywhere?

The secret stays in memory only. It is never sent to a server. You can optionally save it to the encrypted browser vault, which is protected by your passphrase.

Why is my generated code different from my authenticator app?

Clock drift between your device and the authenticator is the most common cause. Ensure your system clock is synchronized. Algorithm, digits, and period must also match the account configuration.

Is it safe to use this instead of a dedicated authenticator app?

For development and testing, yes. For production accounts, a dedicated authenticator app on a separate device provides better security isolation. This tool is a supplement, not a replacement.

TOTP / 2FA Codes

Generate ephemeral RFC 6238 codes from Base32 secrets or otpauth URIs.

Local

Base32 secret or otpauth URI

Nothing is saved. The secret is cleared from component memory when you leave this tool.

Current code

— —

Waiting for a valid secret

Browser clipboard previews and screenshots cannot be suppressed. Clear copied codes after use if your environment requires it.

Working notes

Use TOTP / 2FA Codes with the boundary visible.

TOTP / 2FA Codes computes RFC 6238 one-time codes from a Base32 secret or otpauth URI in memory and can explicitly save a record only to the encrypted browser vault.

What is TOTP / 2FA Codes?

Two-factor authentication (2FA) adds a second layer of security beyond a password by requiring a time-based one-time password (TOTP) that changes every 30 seconds. TOTP is defined by RFC 6238 and works by combining a shared secret (a Base32-encoded key provisioned during setup) with the current Unix timestamp, then applying HMAC-SHA1 (or SHA-256/SHA-512) to produce a short numeric code — typically 6 or 8 digits. Both the authenticator app and the server compute the same code independently, so no network communication is needed to generate or verify codes. The shared secret is usually provisioned via a QR code containing an otpauth:// URI that encodes the secret, issuer, account name, algorithm, digit count, and period. This tool parses otpauth URIs or raw Base32 secrets and computes the current TOTP code locally in your browser. The secret stays in memory and is never sent to any server. You can optionally save secrets to an encrypted browser vault protected by your passphrase for convenient access.

When to use it

Verifying authenticator setup — decode an otpauth:// URI to confirm the issuer, account, algorithm, and period before adding it to your authenticator app.
Backup authenticator — generate TOTP codes when your primary authenticator app is unavailable (phone lost, being repaired).
Development and testing — generate test TOTP codes for a known secret when building or debugging 2FA flows in your application.
Auditing 2FA configuration — check whether a service uses SHA-1, SHA-256, or SHA-512 and whether the digit count and period match expectations.
Migration between authenticator apps — extract the secret from one app and verify it produces the same codes before deleting the old entry.

How to use it

01Paste a Base32 secret or otpauth:// URI into the masked input field.
02Review the parsed configuration: issuer, account, digits (6 or 8), period (usually 30 seconds), and algorithm (SHA-1, SHA-256, or SHA-512).
03The current TOTP code is displayed with a countdown timer showing when it expires.
04Copy the code for use in a login flow.
05Optionally save the secret to the encrypted browser vault for future access, or clear the input to remove it from memory.

Common mistakes

Clock synchronization — TOTP depends on the current time. If your device clock is more than 30 seconds off from the server, codes will not match. Enable automatic time synchronization.
Confusing the secret with the code — the Base32 secret is a permanent key that generates codes. The 6-digit code changes every 30 seconds. Never share the secret; it grants permanent 2FA access.
Losing recovery codes — if you lose access to your authenticator and have no recovery codes, you may be locked out of your account permanently. Always save recovery codes in a secure location.
Screenshot risk — a screenshot or screen recording of the QR code or secret grants permanent 2FA access. Be cautious when sharing screens during setup.
SHA-1 is not a vulnerability here — while SHA-1 is not collision-resistant for signatures, HMAC-SHA-1 is still secure for TOTP code generation. Most services use SHA-1 by default.

Synthetic example

Inspect an otpauth configuration

Input

otpauth://totp/Example:demo?secret=PUBLICSAMPLEONLY&issuer=Example

Result

Issuer and account are parsed; a time-based code is computed only for valid Base32 input.

Related standards

Limits and data boundary

Documentation uses a deliberately invalid public sample, never a working authenticator secret.
Device clock error and unsupported issuer parameters can make generated codes fail.

Frequently asked questions

What is TOTP?: TOTP (Time-based One-Time Password) is a standard (RFC 6238) used by most two-factor authentication apps. It generates a short-lived numeric code from a shared secret and the current time.
Is my secret key stored anywhere?: The secret stays in memory only. It is never sent to a server. You can optionally save it to the encrypted browser vault, which is protected by your passphrase.
Why is my generated code different from my authenticator app?: Clock drift between your device and the authenticator is the most common cause. Ensure your system clock is synchronized. Algorithm, digits, and period must also match the account configuration.
Is it safe to use this instead of a dedicated authenticator app?: For development and testing, yes. For production accounts, a dedicated authenticator app on a separate device provides better security isolation. This tool is a supplement, not a replacement.

Keep working

UUID / ULID GeneratorGenerate secure UUID v4, UUID v7, and ULID batches locally.JWT Token InspectorInspect headers, claims, and expiry without implying verification.Password GeneratorGenerate credentials from cryptographically secure browser randomness.Hash GeneratorCreate MD5, SHA-1, SHA-256, and SHA-512 UTF-8 digests locally.