2FA Code Generator (TOTP)
Turn a Base32 secret into live two-factor codes, check a code, and build an otpauth:// link — all in your browser.
🔒 Codes are calculated on your device. The secret is never uploaded or saved.
About the 2FA Code Generator (TOTP)
Time-based one-time passwords (TOTP, RFC 6238) are the six-digit codes shown by Google Authenticator, Microsoft Authenticator, Authy and most password managers. The app and the server share a secret key; every 30 seconds both sides compute an HMAC of the current time step and keep a few digits of the result, so the codes match without any network connection. This tool does the same calculation with your browser’s Web Crypto API. Paste the Base32 secret shown under a QR code (or generate a new one), and you will see the current code with a countdown, the previous and next codes, and a check that accepts one step of clock drift like most servers do. Developers can use it to test a 2FA login flow and to build the otpauth:// URI that authenticator apps import. The secret is never uploaded or stored, but treat real secrets like passwords.
FAQ
Why does my code not match the authenticator app?
Check that the secret is copied completely, that the digits, period and algorithm match the app (most services use 6 digits, 30 seconds and SHA-1), and that your device clock is correct. TOTP depends on the time, so a clock that is off by more than 30 seconds gives different codes.
Is it safe to paste my 2FA secret here?
The code is calculated locally with Web Crypto and nothing is sent to a server. Still, anyone who has your secret can generate your codes, so only use real secrets on a device you trust and prefer test secrets when developing.
What is an otpauth:// URI?
It is the standard link format inside 2FA QR codes. It contains the secret, the account label, the issuer and the settings (algorithm, digits and period), so an authenticator app can add the account in one step.