[{"data":1,"prerenderedAt":54},["ShallowReactive",2],{"tool-guide:totp-generator":3},{"overview":4,"whatIs":5,"useCases":6,"steps":12,"commonMistakes":18,"relatedStandards":24,"example":34,"limitations":38,"faq":41},"TOTP \u002F 2FA Codes computes RFC 6238 one-time codes from a Base32 secret or otpauth URI in memory and can explicitly save a record only to the encrypted browser vault.","Two-factor authentication (2FA) adds a second layer of security beyond a password by requiring a time-based one-time password (TOTP) that changes every 30 seconds. TOTP is defined by RFC 6238 and works by combining a shared secret (a Base32-encoded key provisioned during setup) with the current Unix timestamp, then applying HMAC-SHA1 (or SHA-256\u002FSHA-512) to produce a short numeric code — typically 6 or 8 digits. Both the authenticator app and the server compute the same code independently, so no network communication is needed to generate or verify codes. The shared secret is usually provisioned via a QR code containing an otpauth:\u002F\u002F URI that encodes the secret, issuer, account name, algorithm, digit count, and period. This tool parses otpauth URIs or raw Base32 secrets and computes the current TOTP code locally in your browser. The secret stays in memory and is never sent to any server. You can optionally save secrets to an encrypted browser vault protected by your passphrase for convenient access.",[7,8,9,10,11],"Verifying authenticator setup — decode an otpauth:\u002F\u002F URI to confirm the issuer, account, algorithm, and period before adding it to your authenticator app.","Backup authenticator — generate TOTP codes when your primary authenticator app is unavailable (phone lost, being repaired).","Development and testing — generate test TOTP codes for a known secret when building or debugging 2FA flows in your application.","Auditing 2FA configuration — check whether a service uses SHA-1, SHA-256, or SHA-512 and whether the digit count and period match expectations.","Migration between authenticator apps — extract the secret from one app and verify it produces the same codes before deleting the old entry.",[13,14,15,16,17],"Paste a Base32 secret or otpauth:\u002F\u002F URI into the masked input field.","Review the parsed configuration: issuer, account, digits (6 or 8), period (usually 30 seconds), and algorithm (SHA-1, SHA-256, or SHA-512).","The current TOTP code is displayed with a countdown timer showing when it expires.","Copy the code for use in a login flow.","Optionally save the secret to the encrypted browser vault for future access, or clear the input to remove it from memory.",[19,20,21,22,23],"Clock synchronization — TOTP depends on the current time. If your device clock is more than 30 seconds off from the server, codes will not match. Enable automatic time synchronization.","Confusing the secret with the code — the Base32 secret is a permanent key that generates codes. The 6-digit code changes every 30 seconds. Never share the secret; it grants permanent 2FA access.","Losing recovery codes — if you lose access to your authenticator and have no recovery codes, you may be locked out of your account permanently. Always save recovery codes in a secure location.","Screenshot risk — a screenshot or screen recording of the QR code or secret grants permanent 2FA access. Be cautious when sharing screens during setup.","SHA-1 is not a vulnerability here — while SHA-1 is not collision-resistant for signatures, HMAC-SHA-1 is still secure for TOTP code generation. Most services use SHA-1 by default.",[25,28,31],{"title":26,"url":27},"RFC 6238 — TOTP: Time-Based One-Time Password Algorithm","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc6238",{"title":29,"url":30},"RFC 4226 — HOTP: HMAC-Based One-Time Password Algorithm","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc4226",{"title":32,"url":33},"Google Authenticator — Key URI Format","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fgoogle-authenticator\u002Fwiki\u002FKey-Uri-Format",{"label":35,"input":36,"output":37},"Inspect an otpauth configuration","otpauth:\u002F\u002Ftotp\u002FExample:demo?secret=PUBLICSAMPLEONLY&issuer=Example","Issuer and account are parsed; a time-based code is computed only for valid Base32 input.",[39,40],"Documentation uses a deliberately invalid public sample, never a working authenticator secret.","Device clock error and unsupported issuer parameters can make generated codes fail.",[42,45,48,51],{"question":43,"answer":44},"What is TOTP?","TOTP (Time-based One-Time Password) is a standard (RFC 6238) used by most two-factor authentication apps. It generates a short-lived numeric code from a shared secret and the current time.",{"question":46,"answer":47},"Is my secret key stored anywhere?","The secret stays in memory only. It is never sent to a server. You can optionally save it to the encrypted browser vault, which is protected by your passphrase.",{"question":49,"answer":50},"Why is my generated code different from my authenticator app?","Clock drift between your device and the authenticator is the most common cause. Ensure your system clock is synchronized. Algorithm, digits, and period must also match the account configuration.",{"question":52,"answer":53},"Is it safe to use this instead of a dedicated authenticator app?","For development and testing, yes. For production accounts, a dedicated authenticator app on a separate device provides better security isolation. This tool is a supplement, not a replacement.",1788868140984]