TOTP Generator — 2FA Authenticator Codes in Your Browser
Generate RFC 6238 authenticator (2FA) codes from a Base32 secret entirely in your browser — the secret is never sent, stored, or logged. Supports 6/8 digits, 30/60 s periods, SHA-1/256/512, with a live countdown.
🔒 Runs entirely in your browser. Your input and output are never sent to a server or stored — fully private.
Enter your Base32 secret to see codes.
🔑 Codes are computed in this page with the Web Crypto API — your secret stays in the page memory only and is never sent, stored, or logged. Still, treat 2FA secrets carefully: use this on a device you trust and close the tab when done.
About this tool
Your authenticator secret is the key to your accounts, so it should never be pasted into a website that phones home — and here it is not: this generator runs entirely in your browser, computes standard TOTP codes (RFC 6238) with the Web Crypto API and sends nothing anywhere. Paste a Base32 secret and you get the current 6-digit code with a live countdown to the next one. It works offline once loaded, which makes it useful for checking a backed-up secret, debugging 2FA setup or generating a code on a machine without your phone.
Frequently asked questions
What exactly is the Base32 secret and where do I find it?
It is the shared key a service gives you when you enable two-factor authentication — usually shown as a string like JBSWY3DPEHPK3PXP next to the QR code, or embedded in the otpauth:// URL the QR code contains. Both your device and the server hold this same secret; every 30 seconds each side hashes it with the current time to produce the matching 6-digit code. Treat it like a password: anyone who has the secret can generate your codes forever.
The codes are rejected by the website. Why?
Almost always a clock problem. TOTP codes are computed from the secret plus the current time in 30-second steps, so if your device's clock drifts by a minute, you are generating codes for the wrong time window. Enable automatic time synchronization in your operating system settings and try again. If the clock is correct, double-check the secret for typos — Base32 uses only the letters A–Z and digits 2–7, so 0, 1, 8 and 9 never appear.
Can this replace my authenticator app? Is the secret stored?
Treat it as a viewer and a backup aid, not a daily driver. The secret is used only in memory to compute codes — it is never sent to a server and never written to storage, and it disappears when you close the tab. That privacy is a feature, but it also means nothing is saved for next time. For everyday logins, keep secrets in a dedicated authenticator app or password manager, which stores them encrypted and survives restarts. It works offline once the page has loaded.