TOTP Code Generator
Generate live 2FA codes and verify TOTP secrets — entirely in your browser, no upload, no account.
TOTP Code Generator creates live, time-based one-time passcodes (RFC 6238) for two-factor authentication directly in your browser. Enter or generate a Base32 secret, choose the algorithm, digit count, and period, and get a real-time code with a QR code for any authenticator app. A Verify mode checks whether a code matches a secret. Nothing is ever sent to a server. Built by FreeToolHub.
Generate a live code
Enter a Base32 secret key or generate a random one, then get a live time-based code and a QR code for any authenticator app.
Enter or generate a secret key to see a live code.
Scan with your authenticator app
Scan this QR code with Google Authenticator, Authy, 1Password, or any TOTP-compatible app.
Everything runs locally using the Web Crypto API — your secret keys are never sent to a server or stored.
Verify a code
Paste a Base32 secret and the code from your authenticator app to check whether it matches.
A free, standards-based (RFC 6238) TOTP generator and verifier for testing, development, and checking two-factor setups.
Frequently Asked Questions
What is a TOTP code and how does this tool work?
TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind most six-digit 2FA codes. It combines a secret key with the current time using HMAC, then truncates the result into a short numeric code that changes on a fixed interval — 30 seconds by default. This tool computes that code, and verifies codes against a secret, entirely in your browser.
Is my secret key sent to a server?
No. Every calculation uses the Web Crypto API running locally in your browser. Your secret keys, account names, and codes are never transmitted anywhere or stored.
Can I use this to set up 2FA on a real account?
The codes it generates follow the same RFC 6238 standard used by Google Authenticator, Authy, 1Password, and most other authenticator apps, so a secret entered here will produce matching codes. For a real account, it's best to get the secret directly from the service you're securing — use this tool to test setups, recover a lost secret you already control, or verify that a code matches before you rely on it.
Why does the code change every 30 seconds?
TOTP codes are valid for one time step, which is 30 seconds by default (some services use 60). When a time step ends, a new code is calculated from the same secret and the new time value, replacing the old one.
What if my code doesn't match what my authenticator app shows?
The most common cause is clock drift — TOTP depends on your device's clock being accurate. Also double-check the algorithm, digit count, and period match what the service expects. Verify mode allows a one-step tolerance in either direction to absorb small clock differences.
Does this support SHA-256, SHA-512, or 8-digit codes?
Yes. Most services use the RFC 6238 default — SHA-1, 6 digits, 30-second period — but this tool also supports SHA-256 and SHA-512 hashing and 8-digit codes for services that use those variants.