OTP / TOTP Generator
CryptoGenerate TOTP codes (RFC 6238) from a base32 secret for 2FA and MFA authentication. Drop-in 2FA codes matching Google Authenticator and Authy or FreeOTP output.
------Related Tools
About OTP / TOTP Generator
An OTP is the rotating code in two-factor auth that refreshes every few dozen seconds, most commonly the time-based TOTP (RFC 6238).It works by computing an HMAC over a shared secret and the current time window, then truncating to a 6-digit number, so the server and your authenticator app derive the same code without any network. This tool generates TOTP codes locally in your browser from the Base32 secret you provide, shows the remaining seconds, and supports custom digits and period. For example, providing a shared secret yields the current 6-digit TOTP code with seconds remaining, matching your Authenticator app.
How to Use
- Open the OTP / TOTP Generator tool
- Enter the content and set the parameters
- Adjust the output options as needed
- Click the Generate button; results appear in real time
- Copy or export the result
Use Cases
- Debug 2FA integration — Compute TOTP locally from the server-issued secret to confirm your verification logic matches the standard.
- Cross-check authenticators — Compare codes from this tool with Google/Microsoft Authenticator to pinpoint time-drift issues.
- Emergency code — When your phone is unavailable, generate the current code in the browser from a known secret to log in.
- Automated testing — Produce predictable test codes for a 2FA-enabled account in a development environment.
- Diagnose clock skew — Watch the remaining seconds and server rejections to tell whether clock desync causes failures.
- Backup code test — Generate a TOTP code to verify that your backup 2FA recovery codes are stored correctly.
- Secret rotation — Use a newly rotated Base32 secret to confirm the new code works before switching the server over.
FAQ
How do TOTP and HOTP differ?
HOTP (RFC 4226) uses an incrementing counter that steps each use; TOTP (RFC 6238) replaces the counter with current time divided by a period, so the code refreshes automatically over time, the mainstream choice for phone authenticators.
Why does my code not match the server?
The most common cause is clock desync. TOTP depends heavily on accurate time, and a drift of tens of seconds yields a different code. Sync your system clock; most servers also tolerate one window before and after.
Why is the secret in Base32?
2FA secrets are usually Base32 because it uses only uppercase letters and digits with no ambiguous characters, easy to share as a QR code or text. The tool decodes Base32 back to raw bytes before the HMAC.
What are the default digits and period?
The industry default is 6 digits, a 30-second period, and HMAC-SHA1 underneath, the standard for nearly all authenticators and services. Some systems use 8 digits or SHA256, which this tool can match.
Is generating codes in a browser safe?
The computation is local and the secret is not uploaded, but putting a 2FA secret in a browser weakens the isolation of the "second factor." Use it for debugging; for the long term, prefer a dedicated authenticator app or hardware key.