Skip to content
TextArray1.41.0
100% local

TOTP code generator

Generate time-based (TOTP) or counter-based (HOTP) one-time codes from a shared secret.

Output
Related tools
HMAC generatorDeveloper tools
Hash generatorDeveloper tools
Password generatorRandom generators
LRC lyrics generatorRandom generators
Test IBAN generatorRandom generators
Random name generatorRandom generators
TOTP code generator
Paste a Base32 shared secret — the same one shown as text or hidden inside a QR code when you set up two-factor authentication — and this tool generates the current six-, seven- or eight-digit one-time code, exactly like an authenticator app. It follows RFC 6238 (TOTP, time-based) by default, with RFC 4226 (HOTP, counter-based) available as a mode switch for services that step a counter instead of the clock.
You can also paste a full otpauth:// URI instead of a bare secret. These are the strings authenticator apps read from a QR code — otpauth://totp/Issuer:account?secret=…&algorithm=…&digits=…&period=… — and this tool parses one automatically, filling in the algorithm, digit count and period from the URI so you don't have to copy each field by hand. Algorithm choices are SHA-1 (the default nearly every service still uses), SHA-256 and SHA-512; digit count is 6, 7 or 8; the period defaults to the standard 30 seconds but can be changed to match a nonstandard setup.
Set the verification window above zero to also see the codes for the steps just before and after the current one — useful when debugging clock drift between a server and a client, since a server that accepts a ±1 step window will validate a code your device shows a few seconds early or late. In HOTP mode, the same window shows the codes around a given counter value instead of a time step.
Everything runs through the Web Crypto API in your browser: the secret is read from a masked field, is never written to local storage and never leaves your device, exactly like the app it's standing in for. Copy the code, download it as a .txt file, or move it into another tool's input — there's nothing to upload and nothing to configure on a server.
FAQ
What secret format does it expect?
A Base32-encoded secret — the same format authenticator apps use, usually shown as a block of uppercase letters and digits 2-7. Spaces and dashes in the secret are ignored, so pasting it grouped in fours is fine.
Can I use the QR code setup string directly?
Yes. Paste the full otpauth://totp/… or otpauth://hotp/… URI into the secret field and the algorithm, digit count, period and counter are read from it automatically, overriding the option controls below.
What's the difference between TOTP and HOTP?
TOTP derives the code from the current time, so it changes every period (usually 30 seconds). HOTP derives it from a counter that increments by one on each use, so the code stays the same until you advance the counter yourself.
Why would I use the verification window?
It generates the neighboring codes too, which is how a server tolerates small clock drift: if your device's clock is a few seconds ahead or behind, the code it shows may match the previous or next step rather than the current one.
Is my secret uploaded anywhere?
No. The secret is read from a masked field, the HMAC computation runs entirely in your browser via the Web Crypto API, and nothing is sent to a server or saved to local storage.