TOTP Authenticator
Live 2FA codes from any base32 secret — no app needed
How time-based codes actually work
TOTP turns a shared secret and the current time into a short code: both sides divide time into 30-second windows, HMAC the window number with the secret, and truncate to 6 digits. Same secret plus same time always yields the same code — no network, no SMS, nothing to intercept in transit.
What this tool does
- 📲 Turns any base32 secret into live rolling codes
- 🔢 6- or 8-digit codes, 30- or 60-second periods
- ⏳ Live countdown bar to the next code
- 🔒 Secrets stay in your browser — computed locally
When to use it
- Logging in on a desktop with no phone at hand
- Testing a 2FA setup you just built
- Keeping a backup way to read codes
Privacy: the secret is used only inside your browser to compute codes — it is never transmitted, stored or logged.
Last updated · 2026-09-01
How codes are computed
Base32-decoded secret plus the 30-second window counter go through HMAC-SHA1; dynamic truncation (RFC 4226) extracts 31 bits and reduces modulo 10^digits. The page re-renders twice a second off the system clock, so background tabs stay accurate.
Why generate codes here?
Standards, not approximations
Real RFC 6238 over RFC 4226 HMAC-SHA1 with dynamic truncation — verified against the official test vectors, so codes match Google Authenticator digit for digit.
Live countdown included
The progress bar shows exactly when the current code dies, so you never type a code with one second left and wonder why it failed.
Secrets that stay secret
Hand-rolled SHA-1 runs locally with zero network calls — pasting a 2FA secret here exposes it to nobody, unlike server-side generators.
Frequently asked questions
Where do I find the secret?⌄
Every service that offers authenticator 2FA shows a QR code plus a text secret (often labeled manual entry or can't scan). Paste that base32 string here — it usually looks like JBSWY3DPEHPK3PXP.
Is it safe to paste my 2FA secret into a website?⌄
On this page, yes by construction: codes are computed locally in your browser and the secret is never sent, stored or logged anywhere. Anyone with your secret can generate your codes, so still treat it like a password.
My code is rejected — why?⌄
Almost always clock skew: TOTP depends on correct time, so check your device clock first (automatic time on). Then verify the secret was copied completely and the service expects 30-second 6-digit codes.
Frequently asked questions
Where do I find the secret?
Every service that offers authenticator 2FA shows a QR code plus a text secret (often labeled manual entry or can't scan). Paste that base32 string here — it usually looks like JBSWY3DPEHPK3PXP.
Is it safe to paste my 2FA secret into a website?
On this page, yes by construction: codes are computed locally in your browser and the secret is never sent, stored or logged anywhere. Anyone with your secret can generate your codes, so still treat it like a password.
My code is rejected — why?
Almost always clock skew: TOTP depends on correct time, so check your device clock first (automatic time on). Then verify the secret was copied completely and the service expects 30-second 6-digit codes.