TOTP Generator

Work out the current authenticator code from a secret, and see exactly when it expires.

Runs on your deviceSecurity & PrivacyWorkingNo account needed

What this tool does

TOTP Generator implements RFC 6238 on top of RFC 4226: it decodes your secret to raw bytes, divides the current Unix time by the period to get a counter, signs that counter with HMAC using the browser's own WebCrypto implementation, and truncates the result to the number of digits you asked for. The arithmetic is checked against the test vectors published in the RFC, for SHA-1, SHA-256 and SHA-512 alike, so a code that disagrees with your phone points at a setting or a clock rather than at the maths.

Input can be the bare base32 secret your service showed you during setup, the same value in hex, or the whole otpauth://totp/ URI that sits behind a setup QR code. A URI is parsed properly: the issuer and account label are read back to you, and its digits, period and algorithm parameters override whatever the settings panel says, because the URI is the authoritative description of that account. Output is a table rather than a single number — the previous window, the current one, and up to ten upcoming windows, each with its code and the local clock times it is valid between. The previous row is there because most servers accept the code from the window just gone, to forgive a few seconds of drift.

The maths is the easy part; two other things decide whether the code is accepted. The first is the clock: time is the only input besides the secret, so a device running two minutes fast produces codes for a window two minutes away, and every one of them is rejected without explanation. The second is that this is not an authenticator app and does not try to be. Nothing is stored, so the secret has to be pasted in again each visit; nothing ticks, so the table is a snapshot from the moment you pressed the button and goes stale when the period runs out. More to the point, the seed is the long-lived credential and the six digits are only derived from it — pasting it into a browser tab is a decision worth making deliberately, on a machine you trust, rather than out of habit.

How to use it

  1. Paste the secret, or the whole otpauth:// URI. Base32 uses A–Z and 2–7; case, spaces, dashes and trailing = padding are all ignored, so the grouped format services print is fine as-is. If you only have the setup QR image, decode it with QR Code Reader first and paste the URI it returns.
  2. Leave digits, period and algorithm alone unless the service is unusual. Six digits, thirty seconds and SHA-1 is what almost every service uses, and it is the default here. Seven and eight digits, periods from 5 to 300 seconds and SHA-256 or SHA-512 are all available for the ones that differ — and an otpauth URI sets them for you regardless.
  3. Set the secret encoding explicitly if the secret is hex. Auto tries base32 first and falls back to hex only when base32 decoding fails. A hex secret built solely from the letters a–f and the digits 2–7 is also valid base32, so it decodes quietly to the wrong bytes and yields wrong codes. Choose Hex when you know that is what you have.
  4. Choose how many upcoming windows to list. Zero to ten. The previous window is always included, so the shortest possible table still has two rows: the one before now and now.
  5. Generate the codes and read the summary. It names the current code, the seconds left on that window, and the issuer and account if a URI supplied them. Run it again for a fresh code; the table does not refresh on its own.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

The phone with the authenticator app is not to hand

If you kept the base32 seed when you set 2FA up, the code can be derived from it directly, which beats burning a single-use recovery code to get back in.

Checking a 2FA implementation you are writing

Generate the code independently of your own library and compare. When the two disagree, the digits, period, algorithm and window columns here narrow down which of them is wrong.

Moving a secret between authenticator apps

Confirm the new app produces the same code as this page does before deleting the account from the old one, rather than discovering the mismatch when you next need to sign in.

Working out why an otp code keeps being rejected

The valid-from and valid-until times say which window a code belongs to. If your device clock disagrees with the server's, the pattern shows up immediately as a consistent offset rather than random failure.

Questions

Is my secret uploaded anywhere?
No. Decoding and the HMAC both happen in this browser tab through WebCrypto, so the page works with the network disconnected. Nothing is stored either — there is no history and no saved secret, so closing the tab discards it and you paste it again next time.
Why does the code it shows get rejected?
Almost always the clock. TOTP takes the current time and nothing else beyond the secret, so a device a minute out generates codes for the wrong window; correct the system time and try again. Failing that, check the digits, period and algorithm against what the service specified, and remember that the table is a snapshot — a code read a minute ago has already expired.
Can I use this instead of an authenticator app?
It is not built for that. There is no storage, no countdown and no notification, and it asks you to handle the raw seed every time you want six digits — the opposite of what an authenticator app is for. Keep the seed in an app or a password manager, and use this page for recovery, testing and checking one code against another.
Does it read QR codes or counter-based HOTP secrets?
Neither directly. It takes the otpauth://totp/ URI as text, including its secret, issuer, label, digits, period and algorithm parameters, but it does not decode images — QR Code Reader does that, and flags otpauth payloads when it finds them. An otpauth://hotp URI is refused outright, because counter-based codes need a counter that advances with use, and nothing here tracks one.
What secret formats are accepted?
Base32 as printed by services, in any case, with spaces, dashes and padding ignored; and hex, with spaces, dashes and colons ignored. Auto detection tries base32 and falls back to hex, which is right for most hex secrets but not all of them, so the encoding selector is there when you need to be certain.
Why does it show a previous code as well as the current one?
Servers commonly accept the immediately preceding window so that a code typed a few seconds late still works. Seeing it makes clock drift diagnosable: if the code that is accepted is consistently the previous one, your device is running fast.

Related tools

  • Protect PDF — Add a password and set permissions on a PDF.
  • Sign PDF — Draw, type or upload a signature and place it on the page.
  • Hash Generator — Compute MD5, SHA-1, SHA-256 and SHA-512 digests.
  • Password Generator — Generate strong passwords with rules you control.
  • Redact PDF — Permanently remove sensitive content, not just cover it.
  • Remove PDF Metadata — Strip identifying metadata before you share a file.