TOTP Generator — Live 2FA Authenticator Code

This tool generates real, standards-compliant Time-based One-Time Password (TOTP) codes from a Base32 secret, the same six-digit rotating codes shown by apps like Google Authenticator or Authy. Paste the secret you were given when setting up two-factor authentication — the same string usually hidden behind a QR code — and watch the live code count down and refresh every 30 seconds, exactly like it would inside a phone app. It is meant for testing and verifying 2FA secrets you own or control: debugging a login flow you are building, confirming a backup code before you throw away a provisioning QR, or double-checking that a secret was typed in correctly.

Under the hood this is a genuine implementation of RFC 6238 (TOTP) built on RFC 4226 (HOTP), not a cosmetic countdown. The Base32 secret is decoded per RFC 4648 into raw key bytes, the current Unix time is divided by the time step to get a moving counter, and that counter is encoded as an 8-byte big-endian buffer. The browser's native Web Crypto API (crypto.subtle) computes an HMAC over that buffer with your chosen hash — SHA-1 remains the near-universal default for compatibility with existing authenticator apps, while SHA-256 and SHA-512 are offered for setups that support the stronger variants. RFC 4226's dynamic truncation then pulls four bytes out of the HMAC output at an offset taken from its last byte, masks off the top bit, and reduces the result modulo 10^6 or 10^8 to produce the 6- or 8-digit code — the exact same arithmetic your phone's authenticator app runs internally.

Every part of the process happens locally: there is no server component, no analytics beacon carrying your secret, and no external API call of any kind. The Base32 text you paste into the field is parsed directly by JavaScript running in your tab and never leaves it. That makes this a safe way to sanity-check a 2FA secret on a machine you trust, though as with any tool that touches authentication material, you should still avoid pasting secrets on shared or public computers and should only ever use this on codes tied to accounts you own or are explicitly authorized to test.

The algorithm, digit count and time-step controls exist because real-world TOTP deployments are not perfectly uniform: most consumer services use SHA-1 with 6 digits and a 30-second step, but some enterprise and developer tools issue SHA-256 or SHA-512 secrets, 8-digit codes, or non-standard time steps like 15 or 60 seconds. Matching these settings to whatever a provisioning URI or setup page specifies lets you reproduce exactly the code your authenticator app would show, which is invaluable when you are implementing your own TOTP verification server and need a trustworthy, offline reference to compare against.