TOTP generator
Paste a 2FA secret to get the same six-digit code as your authenticator app, or create a new secret with a QR code. Computed in your browser, never uploaded.
Settings (digits, period, algorithm)
How your authenticator gets six digits
Your phone and the server share one secret. Each side runs the same five steps on the current time and gets the same code, without ever talking to each other. Step through it with the secret above (add or generate one first).
TOTP in practice
TOTP is defined in RFC 6238 and builds on HOTP (RFC 4226), which uses a counter instead of the clock. Almost every “authenticator app” 2FA implementation uses the defaults: SHA-1, 6 digits, 30 seconds. SHA-1’s collision weakness doesn’t affect HMAC, so this is still considered safe.
Servers usually accept the code from one period either side, to allow for clock drift and slow typing.
If you’re building 2FA
- Generate at least 160-bit secrets from a CSPRNG and store them encrypted.
- Rate-limit code attempts: six digits is only a million combinations.
- Reject a code once it has been used, so it can’t be replayed within its window.
- Offer recovery codes, and consider passkeys (WebAuthn), which resist phishing in a way TOTP does not.
Questions people ask
What is a TOTP generator?
TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind the six-digit codes in Google Authenticator, Microsoft Authenticator, Authy and 1Password. Given the same secret and the current time, this page computes the same code your authenticator app shows.
Is it safe to paste my 2FA secret here?
The code is computed in your browser with the Web Crypto API and the secret is never sent anywhere or saved. Still, a TOTP secret is as sensitive as a password: anyone who has it can generate your codes. Use this for testing, development and recovery, not as your everyday authenticator.
Where do I find the TOTP secret?
When you set up two-factor authentication, most sites show a QR code and a “can’t scan it?” link that reveals the secret as a Base32 string of letters A–Z and digits 2–7. The QR code itself contains an otpauth:// link with the same secret.
Why doesn’t my code match the app?
The usual causes are a clock that is off by more than a few seconds, or non-default settings: some services use 8 digits, a 60-second period or SHA-256. Check your device’s time is set automatically, then match the settings here to the service.
Can I create a new TOTP secret for my own app?
Yes. “New random secret” creates 160 random bits (the RFC 4226 recommended length) encoded as Base32, plus a QR code any authenticator app can scan. Store the secret on your server encrypted, and verify codes server-side with a library.