OTP / TOTP Generator
CryptoGenerate TOTP codes (RFC 6238) from a base32 secret for 2FA and MFA authentication. Drop-in 2FA codes matching Google Authenticator and Authy output.
------About OTP / TOTP Generator
An OTP is the rotating code in two-factor auth that refreshes every few dozen seconds, most commonly the time-based TOTP (RFC 6238). It works by computing an HMAC over a shared secret and the current time window, then truncating to a 6-digit number, so the server and your authenticator app derive the same code without any network. This tool generates TOTP codes locally in your browser from the Base32 secret you provide, shows the remaining seconds, and supports custom digits and period. The secret stays local and is never uploaded, ideal for debugging 2FA integration, checking a server implementation, or grabbing a code when your phone is unavailable. Tip: Bookmark this tool for quick access whenever you need to generate keys or hashes. All processing happens locally in your browser — no data upload, so it is safe to use with sensitive material.
How to Use
- Open the OTP / TOTP Generator tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- Debug 2FA integration — Compute TOTP locally from the server-issued secret to confirm your verification logic matches the standard.
- Cross-check authenticators — Compare codes from this tool with Google/Microsoft Authenticator to pinpoint time-drift issues.
- Emergency code — When your phone is unavailable, generate the current code in the browser from a known secret to log in.
- Automated testing — Produce predictable test codes for a 2FA-enabled account in a development environment.
- Diagnose clock skew — Watch the remaining seconds and server rejections to tell whether clock desync causes failures.
- Backup code test — Generate a TOTP code to verify that your backup 2FA recovery codes are stored correctly.
- Secret rotation — Use a newly rotated Base32 secret to confirm the new code works before switching the server over.
FAQ
How do TOTP and HOTP differ?
HOTP (RFC 4226) uses an incrementing counter that steps each use; TOTP (RFC 6238) replaces the counter with current time divided by a period, so the code refreshes automatically over time, the mainstream choice for phone authenticators.
Why does my code not match the server?
The most common cause is clock desync. TOTP depends heavily on accurate time, and a drift of tens of seconds yields a different code. Sync your system clock; most servers also tolerate one window before and after.
Why is the secret in Base32?
2FA secrets are usually Base32 because it uses only uppercase letters and digits with no ambiguous characters, easy to share as a QR code or text. The tool decodes Base32 back to raw bytes before the HMAC.
What are the default digits and period?
The industry default is 6 digits, a 30-second period, and HMAC-SHA1 underneath, the standard for nearly all authenticators and services. Some systems use 8 digits or SHA256, which this tool can match.
Is generating codes in a browser safe?
The computation is local and the secret is not uploaded, but putting a 2FA secret in a browser weakens the isolation of the "second factor." Use it for debugging; for the long term, prefer a dedicated authenticator app or hardware key.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.