Where do I get the secret key?
Services show it as a QR code during two-factor setup and usually offer a manual-entry option that displays the Base32 text. Copy that string. The tool ignores spaces and hyphens, so you can paste it in groups.
TOTP Code Generator
Enter a Base32 secret to see the current six-digit code and a countdown to the next one. Useful for testing two-factor setups.
Runs in your browser — nothing is uploaded
— — —Loading the current time…
Codes are computed in your browser with the standard TOTP settings (SHA-1, 6 digits, 30-second steps). Your secret never leaves this page. Only enter secrets for accounts you are allowed to manage.
About the TOTP Code Generator
Time-based one-time passwords (TOTP, RFC 6238) are the six-digit codes shown by authenticator apps. Each code is an HMAC of the current 30-second time step, computed with a shared secret that the service gives you as a Base32 string during enrolment.
This page uses the settings almost every service uses: HMAC-SHA1, six digits and 30-second steps. Developers use it to check that a secret was copied correctly, to test login flows without a phone, and to confirm that a server’s clock agrees with the codes it expects.
The secret is the credential that protects the account, so treat it like a password. The page computes codes locally and never sends the secret anywhere, but do not paste production secrets into shared or public computers.
FAQ
TOTP Code Generator — frequently asked
Why does my code not work even though the secret is right?
Most often the device clock is wrong. TOTP depends on the current time, so an offset of more than about 30 seconds breaks it. Also check that the service uses SHA-1, six digits and 30-second steps, because some tokens use other settings.
How long is each code valid?
Each code belongs to one 30-second window. Many servers also accept the previous and next code to allow for small clock differences, which is why a code can still work for a short time after it changes.
Is this the same as Google Authenticator?
It follows the same standard. For a given secret and time, the codes match what an RFC 6238 authenticator produces with default settings. This page is a convenient test tool, not a replacement for keeping the secret on a dedicated device.
Does the tool store my secret?
No. The secret stays in the page state and disappears when you close the tab. Nothing is written to cookies, local storage or a server.
What makes a secret invalid?
Base32 uses only the letters A to Z and the digits 2 to 7. The digits 0, 1, 8 and 9 and most punctuation do not exist in the alphabet, so the tool rejects them. Spaces and hyphens are ignored.
Related tools
HMAC GeneratorCompute an HMAC signature for a message and secret key in hex or Base64, the same way most webhook and API providers do.UUID Generator (Version 4)Create one or one hundred random UUID v4 values in a single click, formatted the way your database or code expects.Password GeneratorBuild a random password with the length and character sets you need. It is generated locally with a cryptographically secure random source.