Generate the current TOTP 2FA code from a Base32 secret in your browser. Choose 6 to 8 digits, the time step, and SHA1, SHA256 or SHA512.
Runs in your browser — your input is processed on this device and never uploaded.
RFC 4648 Base32 with no padding, the same secret stored in the authenticator app.
Results appear here.
TOTP, the time-based one-time password, is the six-digit 2FA code that authenticator apps show. Both sides compute it from a shared Base32 secret and the current time, so the same secret, time step and hash always produce the same digits. Apps refresh the code every 30 seconds by default.
This TOTP generator computes the current code from a secret in your browser.
The result is the code, the period used, and how many seconds remain before it changes. Run it again after that for the next code.
Passwords leak. A second factor that changes every 30 seconds means a stolen password is not enough on its own. SMS codes travel over a phone network you do not control, while TOTP keeps the secret on the device.
The algorithm is small and standard (RFC 6238), so every major authenticator app computes the same codes. A site can say scan this and skip building its own second factor.
Developers use a generator like this one to test a login flow, to check that a secret was copied correctly, or to compare codes when an app and a server disagree.
For your own accounts, use an authenticator app such as Google Authenticator, Microsoft Authenticator, Aegis or 2FAS, or your password manager's built-in TOTP. A browser tab is a fine place to test a secret and a poor place to keep a real second factor.
QR Code Generator on ToolkitBay can draw an otpauth link so an app imports the secret without typing it. Hardware security keys (WebAuthn) resist phishing better than any code, because they are bound to the site's address. Use them where the account is worth it.
This page computes codes. It does not enroll an account, store a secret, or verify a code with a clock skew window the way a server does.
SHA1 with 6 digits and a 30 second period is what the RFC 6238 examples and Google Authenticator made standard. SHA256 and SHA512 are in the same RFC. Change the hash, digits or period on one side only and the codes never match, with no hint about which setting is off.
Codes that never match are usually a clock problem. If the device's time is a minute off, every code is two steps off.
Anyone who has the secret can make valid codes forever. Treat it like a password, and treat a screenshot of the setup QR code the same way.
The code is computed in your browser. The secret is not sent to ToolkitBay's servers.
Find similar tools by category or tag.