TOTP Two-Factor Code Generator
Generate TOTP two-factor authentication codes online. Enter or randomly generate a Base32 secret and the tool shows the code for the current time window plus the previous and next ones, matching apps like Google Authenticator.
FreeOnline Tool
Loading…
How to Use
- Enter an existing Base32 OTP secret, or click to generate a random one
- The page shows the six-digit code for the current time window in real time, along with the codes for the previous and the next window, which helps when clocks are slightly out of sync
- Codes refresh automatically as time passes and match what Google Authenticator and similar apps produce
Features
- Generates codes with the standard TOTP (time-based one-time password) algorithm, compatible with Google Authenticator, Microsoft Authenticator and other mainstream authenticator apps
- Accepts your own Base32 secret, or generates a valid random secret with one click
- Shows three codes at once, for the current window and the two adjacent windows, which makes it easy to handle small clock differences between client and server
- Validates the secret and tells you when the input is not valid Base32
Use Cases
Developing two-factor login
Generate codes from a known secret while building TOTP-based sign-in so you can verify the server-side validation logic.
Standing in for an authenticator app in test environments
Complete a login test without a phone app by computing the current code directly from the secret.
Investigating failed code verification
When you suspect a device clock offset is causing verification failures, compare the current window's code against the adjacent ones.
Learning how TOTP works
Generate real codes to see for yourself how a secret and the current timestamp combine into a rotating one-time password.
FAQ
Why are three codes shown instead of one?
TOTP codes normally rotate every 30 seconds, and because client and server clocks can be a few seconds apart, many systems accept the current window plus the ones immediately before and after it. Showing all three makes those edge cases easy to investigate.
What is a Base32 secret and where do I get one?
Base32 is the encoding the TOTP standard uses for secrets. It is the string of uppercase letters and digits an application shows you when you enable two-factor authentication, the text equivalent of the QR code. The tool can also generate a valid random secret for testing.
Do the codes match Google Authenticator?
Yes. Given the same secret, the standard TOTP calculation used here produces exactly the same codes as Google Authenticator, Microsoft Authenticator and other mainstream authenticator apps.
Is the secret I enter sent to a server?
No, all codes are computed locally in your browser and the secret is never uploaded. Even so, a real production two-factor secret is highly sensitive, so avoid storing or repeatedly entering one in any online tool.