TOTP 2FA Code Generator
Generate the current, previous and next TOTP codes for a Base32 secret, with a countdown, SHA-1, SHA-256 or SHA-512, 6 or 8 digits, and the otpauth URI.
Free · No sign-up · Your inputs stay in your browser
Input
Generate TOTP codes (2FA)
Output
…
otpauth URI (encode it as a QR code)
otpauth://totp/gohacks:ada%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=gohacks
RFC 6238: an HMAC of the number of 30-second steps since 1970, cut down to 6 digits. Most authenticator apps only honour SHA-1, 6 digits and 30 seconds and silently ignore the rest, so change those only when both ends are yours. Servers usually accept the previous and next code to allow for clock drift.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
How TOTP works
RFC 6238 counts 30-second steps since 1970, signs the count with HMAC and the shared secret (RFC 4226), and keeps 6 digits of the result. Both sides compute it independently, so the only things that can go wrong are the secret and the clock.
Testing your own 2FA
Paste the secret your app generated to check that its codes match, without reaching for a phone. Servers usually accept the previous and next code too, to allow for clock drift. If every code is rejected, check the server clock against NTP first.
Stick to the defaults
Google Authenticator and many other apps ignore the algorithm, digits and period parameters and always use SHA-1, 6 digits and 30 seconds. SHA-1 is not a weakness here: HMAC-SHA1 is not affected by SHA-1 collisions.