Generate 6-digit rolling TOTP codes and otpauth URIs from Base32 secrets.
Updated
------
Refresh in 30s
Quick start
Generate secret, view 6-digit rolling code and copy otpauth URI.
Enter label metadata used in authenticator apps.
Create a random base32 shared secret.
Use current code or otpauth URI for app enrollment.
In-depth guide
Time-based One-Time Passwords (TOTP, RFC 6238) are the rotating 6-digit codes that authenticator apps such as Google Authenticator and Authy display for two-factor login. This tool generates a secret, builds the otpauth:// URI you can scan, and shows the current code — all in your browser — so you can test a 2FA flow end to end.
TOTP combines a shared secret with the current time. The clock is divided into 30-second steps; the step number is fed through HMAC-SHA1 with the secret and truncated to a 6-digit code. Because both the server and your app know the secret and agree on the time, they compute the same code independently — nothing is ever sent over the network to generate it.
otpauth:// URI (or QR) into your authenticator app, or import the secret directly.If a device clock is off by more than a step, codes will not match. That is why most servers accept the previous and next step as well, giving a small tolerance window. If your generated code never matches a real service, check that the device time is set to update automatically.
crypto.getRandomValues and codes are computed locally — nothing is uploaded.RFC 6238 TOTP: 6-digit codes derived from a shared secret and a 30-second time step using HMAC-SHA1.
Yes. Scan or import the generated otpauth:// URI into Google Authenticator, Authy or similar, and the app will produce the same codes.
Usually clock drift. TOTP depends on accurate time, so set your device clock to update automatically; most servers tolerate one step either side.
Both sides know the secret and the current time, so each computes the same code independently. Nothing is sent over the network to generate it.
TOTP has no built-in recovery, so keep backup codes from the service. Anyone who copies the secret can generate valid codes, so guard it carefully.
Yes. Secrets use crypto.getRandomValues and codes are computed in your browser — nothing is uploaded.
Keep exploring
Hand-picked utilities that pair well with the one you're on — all free, client-side, and zero-signup.
Encrypt and decrypt text locally with AES-256-GCM and passphrase-derived keys.
Generate signed HS256 JWTs from custom header and payload JSON locally.
Check password breach exposure using Have I Been Pwned k-anonymity range API.
Shrink PDF file size without uploading to a server.
Body Mass Index with metric / imperial inputs and WHO category bands.
Combine multiple PDFs into one in your browser.
Split a PDF by pages or page ranges, download as zip.