About the OTP Generator
Paste a Base32 secret key and get the same 6-digit, 30-second codes an authenticator app would show, with a live countdown to the next refresh. Handy for testing two-factor login flows during development, verifying that a secret was stored correctly, or reading a code when your phone is not to hand. The secret never leaves your browser.
How TOTP codes are generated
TOTP (RFC 6238) combines a shared secret with the current time. The Unix time is divided into 30-second steps, that step counter is HMAC-SHA1-signed with the secret, and a 6-digit number is derived from the result. Because both your device and the server know the secret and the time, they produce the same code independently — no network exchange is needed and each code is valid only for its 30-second window. This tool implements exactly that algorithm with the standard parameters (SHA-1, 6 digits, 30 seconds), so its output matches Google Authenticator, Microsoft Authenticator, Authy, 1Password and every other RFC-compliant app.
Where the secret comes from
- When you enable 2FA, the service shows a QR code and usually a text version of the key — a Base32 string such as JBSWY3DPEHPK3PXP. That string is what you paste here.
- Developers: your backend generates the secret when a user enrols and encodes it in an otpauth:// URI for the QR code.
- Spaces and lower-case letters in the secret are tolerated; they are stripped and normalised before use.
- The issuer and label fields are informational — they identify the account in authenticator apps and do not affect the code.
Security guidance
- Your secret is processed locally and never transmitted, but treat it like a password: anyone with the secret can generate your codes indefinitely.
- Use this tool for development, testing and recovery — for day-to-day logins, a dedicated authenticator app with encrypted backup is safer.
- If the codes do not match the server, check the device clock: TOTP tolerates only about 30 seconds of drift.
- Never share screenshots that include the secret key or its QR code.
How to use the OTP Generator
- 1Paste the secret. Enter the Base32 secret key from the service's 2FA setup screen.
- 2Optionally add issuer and label. Name the service and account so you can tell keys apart.
- 3Read the code. The current 6-digit TOTP appears with a countdown; a new code is generated every 30 seconds.
- 4Copy. Click the code to copy it and paste it into the login form.
Frequently asked questions
- Why does the code here differ from my authenticator app?
- Almost always a clock problem — one of the devices is more than 30 seconds off. Sync the system time. Otherwise check that the secret was pasted completely and that the service does not use non-standard parameters (8 digits, 60 seconds or SHA-256).
- Can I generate HOTP (counter-based) codes?
- This tool generates TOTP only, which is what nearly every consumer service uses. HOTP requires a counter that both sides increment and is rare outside hardware tokens.
- Is it safe to paste my real 2FA secret?
- The code is computed in your browser with no network calls, and nothing is stored. As with any browser tool, use it on a trusted device and avoid public computers.
- How do I get the secret from a QR code?
- Most services show a "can't scan?" link revealing the text key. Alternatively decode the QR image with a reader — the otpauth:// URI it contains has the secret in its secret= parameter.