TOTP Code Generator

Generate the standard 6-digit verification code from your own 2FA secret key.

With TOTP Code Generator, you can do this check or generate this value in seconds, with no account or install needed. TOTP Code Generator makes this small but important security step practical to actually do. Everything runs in your browser — your file or text is never uploaded to a server.

Step-by-step

Find the secret key the service gave you when you turned on two-factor authentication. It's usually shown as text under the QR code, behind a link like 'can't scan the code?'.
Paste it into 'Base32 Secret Key'. Base32 uses only the letters A to Z and the digits 2 to 7, so remove any spaces or dashes that were added for readability.
Click 'Run' to get the 6-digit code.
Enter the code on the service's setup screen, or compare it with what your authenticator app shows at the same moment.

Example

You're adding two-factor login to an app you're building and want to confirm the server produces the right codes. Generate a secret for a test account, enter it here, and compare the result with the code your server expects at that moment. If they match, the algorithm and clock are fine. If they don't, the cause is usually how the secret was encoded or a server clock that has drifted.

TOTP codes are time based and, with the standard settings, change about every 30 seconds. Use a code right after you generate it.

How is a TOTP code produced?

The tool produces a 6-digit code from the shared secret and the current time using HMAC-SHA-1, and the code refreshes every 30 seconds. The verifying server uses the same secret and time, so the codes must match. That is why your device clock has to be correct.

Practical tips

First check that the secret key offered by the site was copied correctly.
Never share the secret key; anyone who has it can generate your codes.
Save backup codes and recovery keys.

Common mistakes

A wrong device clock makes the code get rejected.
Sending the secret key to someone else.
Entering the key of a real account in an environment you do not trust; for sensitive accounts prefer an official authenticator app.

Things to keep in mind

Codes depend on your device clock. If it's off by more than a few seconds, the code may be rejected, so keep automatic time sync on.
The secret key is effectively the second lock on your account. Don't pass real secrets around in screenshots, notes apps or chat messages.
This page isn't a replacement for an authenticator app in daily use. Keep the backup codes the service gives you in case you lose your phone.
Some services use 8-digit codes or a different time step. If codes never match, check whether the service uses the common 6-digit, 30-second setup.