TOTP Authenticator Code Generator

Time-based one-time passwords are the six-digit codes authenticator apps show, changing every thirty seconds, and developers building login flows need a way to produce them from a known secret for testing. This generator does exactly that: paste a base32 TOTP secret, the kind shown when you set up two-factor authentication, and it computes the current six-digit code using the standard HMAC-SHA1 algorithm, along with how many seconds the code remains valid. The computation uses your browser’s Web Crypto API and nothing leaves your device, which matters because a TOTP secret is effectively a password. Use it to test your own systems and to understand how authenticator codes work; never paste a secret for an account you care about into any tool you have not verified works locally.

How to Use the TOTP Authenticator Code Generator

1. Paste a base32 TOTP secret, such as one from a test account setup.
2. Press Generate Code to compute the current code.
3. Read the six-digit code and the seconds remaining.
4. Enter the code into the system you are testing.
5. Generate again when the window rolls over to a new code.

Key Features

• Standard TOTP codes: HMAC-SHA1, thirty-second windows, six digits.
• Base32 secret decoding in the browser.
• Seconds-remaining display so you know when a code expires.
• Web Crypto computation with nothing uploaded.
• Works with any standard authenticator secret for testing.

Best Practices and Tips

• TOTP secrets are sensitive: treat a pasted secret like a password and use test accounts for experimentation.
• Codes change every thirty seconds, so a code with only a few seconds left may expire before you finish typing it.
• If a code is rejected, check your device clock first; TOTP depends on accurate time on both sides.
• Most systems accept the current code and sometimes the previous one, to allow for small clock differences.
• The well-known test secret JBSWY3DPEHPK3PXP is safe to experiment with because it is published in documentation.

Common Mistakes to Avoid

• Pasting a production account secret into an untrusted tool, where it could be captured.
• Assuming a code stays valid after its thirty seconds; it does not, by design.
• Using the wrong secret format; TOTP secrets are base32, not hex or plain text.
• Testing with a live account’s secret instead of a dedicated test account.

Frequently Asked Questions

How does TOTP work?

The server and your authenticator share a secret. Both combine that secret with the current time, counted in thirty-second steps, using HMAC-SHA1, and then take six digits from the result. Because both sides use the same secret and the same time step, they arrive at the same code without communicating.

Why do codes expire after thirty seconds?

Short validity limits the damage if a code is observed or intercepted: an attacker has only seconds to use it, and it cannot be replayed later. The thirty-second window balances security against the practical time needed to read and type a code.

What is a base32 secret?

Base32 is an encoding that represents binary data using the letters A to Z and the digits 2 to 7, which is easy to read and type. Authenticator setup screens show the secret in this form, and this tool decodes it back to bytes before computing the code.

Why might my code be rejected?

The most common cause is clock drift: if the device generating the code and the server differ by more than a step or two, their codes diverge. Other causes are using the wrong secret, the wrong account, or a code that expired mid-entry.

Is it safe to use this with my real secret?

This page computes locally and uploads nothing, but as a standing practice you should test with a dedicated test account rather than a production secret. A secret entered anywhere outside your authenticator app should be treated as potentially exposed.

Related Tools

• PIN Generator – generates random numeric PINs of any length
• Strong Password Generator – creates strong random passwords and memorable passphrases locally
• Password Strength Checker – Entropy and crack-time strength estimate