⏱️ 2FA TOTP Code Generator

Two-factor authentication (2FA) using Time-based One-Time Passwords, or TOTP, is one of the most widely deployed methods for adding a second layer of protection beyond just a password. Apps like Google Authenticator, Authy, and Microsoft Authenticator all implement the same open standard, RFC 6238, which this TOTP Code Generator replicates entirely inside your browser so you can generate live, six-digit codes from any Base32 secret key without installing a separate app.

When a website sets up 2FA and shows you a QR code or a text secret to scan into an authenticator app, that secret is a shared key known only to you and the service. Both sides use the exact same algorithm — combining the secret with the current 30-second time window through an HMAC-SHA1 calculation — to independently arrive at the same six-digit code at the same moment, without ever needing to communicate that code over the network in advance.

How the TOTP algorithm actually works

The process starts by decoding your Base32-encoded secret key into raw bytes. The current Unix timestamp is divided by 30 (the standard time-step interval) and rounded down, producing a counter value that changes exactly every 30 seconds. That counter is converted into an 8-byte message and combined with your secret key using HMAC-SHA1, a cryptographic message authentication algorithm. The resulting hash is then "truncated" using a specific bit-selection process defined in the standard, extracting a 31-bit number that gets reduced to the familiar 6-digit code through a modulo operation. This entire calculation runs locally, using your device's own clock — there's no need to contact any server to know what the current code should be.

Why the codes expire every 30 seconds

The short validity window is a deliberate security feature. Even if someone intercepted a code the moment it was displayed, it would already be useless within seconds, since a completely new code is calculated for the next time window. This is what makes TOTP-based 2FA meaningfully more secure than a static password alone — an attacker would need both your password and continuous, real-time access to your secret key, not just a one-time snapshot of a code.

Practical uses for this tool

This tool is especially useful for developers testing 2FA implementations, for anyone who wants to understand exactly how their authenticator app is generating codes under the hood, or for situations where you need to quickly generate a code from a secret without wanting to add yet another account to your primary phone-based authenticator app. Because everything runs locally and depends on accurate timekeeping, make sure your device's clock is properly synchronized — even a few seconds of drift can occasionally cause a generated code to fall just outside the window a server expects.

Keeping your secret key safe

Treat your TOTP secret key with exactly the same level of care as a password — anyone who has it can generate valid codes for your account indefinitely. Never paste a real account's secret key into a website you don't fully trust. Because this tool runs entirely client-side with no network transmission, it's safe to use with a real secret, but always verify that principle for any tool before trusting it with live 2FA secrets.

TOTP as one layer in a broader security strategy

Even the strongest TOTP setup works best as one layer within a broader approach to account security, alongside a strong, unique password and awareness of phishing attempts that might try to trick you into revealing a valid code in real time. No single control is perfect on its own, but combining several meaningfully independent layers is what makes modern account security genuinely resilient against most real-world attack attempts.

Frequently Asked Questions