TOTP / 2FA Code Generator
Generate live 2FA codes from any secret key — RFC 6238 compliant, verified against official test vectors.
Also known as: 2FA code generator, One-time password generator, Authenticator code generator, OTP generator
How it works
- 1Paste a Base32 secret key, or click New Secret to generate a random one.
- 2Watch the 6 (or 8) digit code update live, with a countdown ring showing time remaining.
- 3Optionally set an account label and issuer, or adjust algorithm/digits/period to match a specific service.
- 4To inspect an existing setup, paste its otpauth:// URI into the import field instead.
Why use TOTP / 2FA Code Generator
Verified against official RFC test vectors
Every RFC 6238 Appendix B timestamp and RFC 4226 Appendix D counter value was checked to produce the exact expected code before this tool went live.
Live countdown, not a static code
The code and its remaining validity window update automatically every second, matching what a real authenticator app shows.
otpauth:// URI import
Paste the setup URI a QR code encodes and every field — secret, algorithm, digits, period, issuer — fills in automatically.
Full algorithm control
SHA-1, SHA-256, or SHA-512, 6 or 8 digits, 30- or 60-second periods — covers the rare service that doesn't use the common defaults.
No app or account needed
Generate a code without installing an authenticator app or scanning a QR code with a phone camera.
Secret never leaves your device
Every step of the algorithm runs locally — nothing about your secret key is ever transmitted anywhere.
Who uses TOTP / 2FA Code Generator
Testing your own 2FA integration
Generate live codes while developing or debugging a service's 2FA flow, without needing a phone nearby.
Getting a code without your phone
If you have the secret key saved securely, generate a valid code even when your usual authenticator app isn't available.
Verifying a secret before committing to an app
Confirm a secret key actually produces valid codes before locking it into an authenticator app you'd need to reset later.
Understanding how 2FA codes actually work
See the underlying secret, algorithm, and countdown that a phone app usually hides behind a single number.
Migrating a secret between devices
Cross-check that a secret was copied correctly by comparing generated codes against your existing authenticator app.
Checking a self-hosted service's OTP setup
Confirm a self-managed 2FA configuration is producing correct codes before relying on it for real logins.
About TOTP / 2FA Code Generator
Time-based One-Time Passwords work by combining a shared secret key with the current time, run through HMAC, to produce a short numeric code that both sides — your app and the service you're logging into — can compute independently without ever transmitting the code itself in advance. It's a genuinely elegant piece of cryptography, standardized as RFC 6238, itself built on the HOTP counter-based scheme from RFC 4226.
This tool implements that exact algorithm from scratch — Base32 decoding, HMAC-SHA1/256/512 via the browser's native Web Crypto API, and RFC 4226's dynamic truncation step — and was verified against the official published test vectors before ever being wired into a UI: every timestamp in RFC 6238 Appendix B, and every counter value in RFC 4226 Appendix D, produces the exact expected code.
Beyond typing a secret in directly, it can also parse an otpauth://totp/... URI — the format encoded into the QR code most services show you during 2FA setup — auto-filling the account label, issuer, algorithm, digit count, and period. That makes it useful for inspecting or re-deriving a setup without needing to re-scan a QR code from scratch.
Every computation — decoding the secret, running the HMAC, truncating to a code — happens locally in your browser using the Web Crypto API. Your secret key is never transmitted anywhere, which matters enormously: a TOTP secret is functionally equivalent to a password, since anyone holding it can generate valid codes indefinitely.
TOTP / 2FA Code Generator vs. other options
How Open Tools Library compares to desktop software and other online tools.
| Feature | Open Tools Library | Desktop software | Other online tools |
|---|---|---|---|
| Price | Free, unlimited | Free apps available | Often ad-heavy or limited |
| Installation | None | App install required | None |
| Secret privacy | Never leaves your device | Stored on device | Often sent to a server |
| otpauth:// import | Built in | Usually via QR scan only | Rarely supported |
| Algorithm flexibility | SHA-1/256/512, custom digits/period | Usually fixed to defaults | Varies |
| Verified correctness | Checked against official RFC test vectors | Unknown, closed source | Usually unknown |
Pro tips
- Almost every real-world service uses SHA-1, 6 digits, and a 30-second period — only change these if the service explicitly documents otherwise.
- A TOTP secret is as sensitive as a password: anyone who has it can generate valid codes indefinitely, so treat it with the same care.
- If a generated code never matches what a service expects, double-check the secret was copied without extra spaces or line breaks — Base32 is strict about its character set.
- TOTP codes rely on your device's clock being roughly accurate — codes will mismatch if your system time has drifted significantly.
Technical specs
- Standard
- RFC 6238 (TOTP), built on RFC 4226 (HOTP)
- Algorithms
- HMAC-SHA1, HMAC-SHA256, HMAC-SHA512
- Digits
- 6 or 8
- Period
- 30 or 60 seconds
- HMAC engine
- Native browser Web Crypto API (SubtleCrypto)
- Processing location
- 100% local, in your browser
Privacy & security
A TOTP secret is functionally equivalent to a password — anyone holding it can generate valid login codes indefinitely, so where it's processed matters enormously.
Your secret key never leaves your browser — every calculation happens locally using the Web Crypto API.
Nothing is stored, logged, or transmitted, whether you type a secret in directly or import an otpauth:// URI.
Closing the tab clears everything — there's no session or history retained anywhere.
The same local-only trust model applies whether you're testing a throwaway secret or a real account's 2FA key.
Frequently asked questions
Is my secret key uploaded anywhere?
No. Every step — decoding, HMAC, truncation — runs locally in your browser using the Web Crypto API. Nothing about your secret is ever transmitted.
Is it safe to use this for my real accounts?
The math is identical to what a phone authenticator app does, and nothing leaves your device — but treat the secret with the same care you'd give a password, since anyone with it can generate valid codes.
What's the difference between TOTP and HOTP?
HOTP (RFC 4226) generates a code from an incrementing counter; TOTP (RFC 6238) is HOTP with the counter derived from the current time divided into fixed periods — this tool implements TOTP, which is what virtually every 2FA setup actually uses.
Can this scan a QR code?
Not directly — paste the secret key or the otpauth:// URI it encodes instead. Most services also show the secret as plain text as a QR code alternative.
How was this verified to be correct?
Against the official RFC 6238 Appendix B and RFC 4226 Appendix D published test vectors, which specify the exact expected code for known secrets, timestamps, and counters.
Troubleshooting
The code doesn't match what my authenticator app shows
Confirm algorithm, digit count, and period all match exactly — a mismatch on any of these produces a completely different, equally valid-looking code. Also check your device's clock is accurate.
Pasting my secret shows no code
The secret field only accepts Base32 characters (A-Z and 2-7) — any spaces, dashes, or other characters are stripped automatically, but if nothing valid remains, no code can be computed.
Importing an otpauth:// URI fails
Make sure you copied the complete URI starting with otpauth://totp/ and including its secret= parameter — a partially copied URI can't be parsed.
Why does the code change if I only adjust the issuer or label?
It shouldn't — issuer and label are purely cosmetic and don't feed into the code calculation. If the code changed, double-check you didn't also alter the secret, algorithm, digits, or period.
Related searches
Landed here looking for something worded a little differently? TOTP / 2FA Code Generator covers all of these too:
Ready to use TOTP / 2FA Code Generator?
Free, private, and ready right now — no signup required.
Scroll to TOTP / 2FA Code Generator