All Tools
1049+ free tools

2FA / TOTP Code Generator

Generate time-based one-time passwords (RFC 6238 TOTP) from a shared secret key, just like Google Authenticator or Authy. Implements HMAC-SHA1 via the Web Crypto API. Your secret never leaves the browser.

Paste the secret from your QR setup — typically starts with letters and 2-7 digits

Your one-time code
------
Refreshes in 30s30s period
HMAC-SHA1
Algorithm
6
Digits
30s
Period
20
Secret bytes
How it works (RFC 6238)
  1. 1. Take the shared secret and the current Unix time, divide time by the period (default 30s) to get a counter.
  2. 2. Compute HMAC-SHA1 of the 8-byte big-endian counter using the secret as key.
  3. 3. Dynamic truncation: take the last 4 bits as an offset, extract 4 bytes at that offset, mask the top bit.
  4. 4. Modulo 10^digits to get the OTP code.

Try this with Google Authenticator

Click “New” to make a fresh secret, then add it manually to your authenticator app as a base32 secret with 30s period and 6 digits. The code shown here will match what your app displays.

RFC 4226 HOTPRFC 6238 TOTPRFC 4648 Base32

Related security tools

Password Analyzer
Deep password analysis: entropy, crack time, vulnerabilities
Password Strength Checker
Analyze password strength & estimate crack time
Memorable Password Generator
Diceware-style passwords from random words
PIN Code Generator
Generate secure 4, 6, or 8-digit PINs