How do I generate a TOTP code from a secret?
Paste your base32 secret and the tool shows the current time-based one-time code, refreshing every second and rolling over each 30 second period. You can set the digit count, period and hash algorithm to match your setup, and copy the otpauth URI. It runs entirely in your browser, so use it for testing rather than a secret that protects a real account.
What TOTP is
TOTP stands for time-based one-time password. It is the short code, usually six digits, that an authenticator app shows for two-factor authentication. When you turn on 2FA and scan a QR code, the app and the server quietly agree on a shared secret. From then on, both sides turn the current time into the same code using the same calculation, so the app can prove you hold the secret without ever sending it anywhere. It is defined in RFC 6238, which builds on the HOTP standard in RFC 4226.
This page does the same maths in your browser. Paste a base32 secret and it shows the live code, the seconds left in the current window, and the otpauth URI that describes the whole setup. It is built for testing an integration and for understanding how 2FA actually works, not for guarding a real account.
Why the code changes every 30 seconds
The clock is divided into fixed windows. By default each window is 30 seconds long, so the current window number is simply the Unix time divided by 30 and rounded down. That number is fed through an HMAC keyed with your secret, and a few bytes of the result are turned into a short decimal code. When the clock ticks into the next window, the number changes and so does the code. That short life is the whole point: even if someone glimpses a code, it is worthless a few seconds later.
Those are the official RFC 6238 test values, using SHA-1 and a 30 second period. Because the code depends only on the secret and the time, any correct implementation produces exactly the same digits, which is how your app and the server stay in step.
The base32 secret
The secret is the shared key, written in base32 so it is made only of the letters A to Z and the digits 2 to 7. That alphabet avoids characters that are easy to confuse and is safe to show as text or pack into a QR code. When an app displays a "setup key" or "manual entry code", that string is the base32 secret. Feed the same secret into any TOTP tool with matching settings and you get matching codes. You can also tweak the digit count, the period and the hash algorithm here, though almost everything in the wild uses six digits, a 30 second window and SHA-1.
The otpauth URI shown below the code is the standard way to describe all of this at once. It packs the secret, issuer, account, digit count, period and algorithm into a single otpauth://totp/... link, which is exactly what sits behind a 2FA QR code.
A clear warning about real accounts
Please do not paste a secret that protects a real account into this page, or any website. The safe home for a genuine 2FA secret is your authenticator app on your own device. The moment a secret is typed into a web page it has left that safe home, and a website you do not control could in principle keep it. This tool runs entirely in your browser and uploads nothing, but the safe habit is the same everywhere: use a throwaway secret to learn and to test, and keep real ones in the app that generated them.
Used that way it is genuinely handy. You can check that your own server issues and verifies codes correctly, reproduce a specific code at a specific time while debugging, or simply watch the numbers roll over to understand what your phone is doing. This is general guidance to help you understand 2FA, not security advice for a specific system.
How we work it out
TOTP as defined in RFC 6238: the base32 secret is decoded to bytes, the counter is the Unix time divided by the period (default 30 seconds), and an HMAC (SHA-1 by default) is computed over the 8-byte counter. Dynamic truncation from RFC 4226 turns the HMAC into a 6 or 8 digit code. Everything runs in your browser.
Frequently asked questions
What is TOTP?
TOTP stands for time-based one-time password. It is the six-digit code an authenticator app shows for two-factor authentication. The app and the server share a secret and both turn the current time into the same short code, so anyone without the secret cannot predict it. It is defined in RFC 6238.
Why does the code change every 30 seconds?
The code is derived from the current time in fixed windows, 30 seconds by default. When the clock ticks into the next window, a new code is produced. That short life is what makes it a one-time password: even if someone sees a code, it is useless moments later.
What is the base32 secret?
It is the shared key, written in base32 (letters A to Z and digits 2 to 7) so it is easy to type or show as a QR code. When you set up 2FA, the secret behind the QR code is this string. Both sides feed it into the same calculation to stay in sync.
Is it safe to paste my real secret here?
Treat this as a testing and learning tool, not somewhere to put a secret that protects a real account. The code is generated entirely in your browser and nothing is uploaded, but a genuine 2FA secret should live only in your authenticator app. Use a throwaway secret to see how TOTP works.
Why does my code not match my server?
The usual cause is a clock that is out of sync, since TOTP depends on the time. Check the digit count, period and algorithm all match the server (most use six digits, 30 seconds and SHA-1). Servers normally accept the codes from one window either side to allow for small clock drift.