TOTP / 2FA Code Generator

Generate a TOTP two-factor code in your browser from any base32 shared secret — the same algorithm that Google Authenticator, 1Password, Authy, and every other authenticator app use. Type a secret and read the code; click the countdown ring to copy. Add multiple accounts, paste an otpauth:// URI to import, and copy one back out to load into another device. The secret and the codes never leave this tab.

Settings

Accounts click the countdown ring to copy the code
Edit account editing — unsaved changes apply live
—

—

About TOTP and this tool
  • TOTP (RFC 6238) is a time-based one-time password: an HMAC of the floor of unix_seconds / period, dynamically truncated to 6 digits. Every 30 seconds, a fresh code is valid.
  • The shared secret is the base32 string the account issuer gave you when you enabled 2FA — it's the same one your authenticator app uses. This tool does the exact same math, so the codes match.
  • Algorithm: HMAC-SHA-1 is what 99% of services use; SHA-256 and SHA-512 are allowed by RFC 6238 but rarely seen. Match what your account issuer expects.
  • Web Crypto: the actual HMAC is computed in your browser via crypto.subtle.sign("HMAC", key, counterBytes). The key is imported once per account with the algorithm you pick.
  • otpauth:// URIs are the standard way to move secrets between apps. Paste URI imports one (label, issuer, secret, algorithm, digits, period all populate). Copy URI exports the current account so you can scan it into another device.
  • Countdown ring: fills as the current window progresses. At the boundary the ring snaps back to empty and the next code takes over — same behaviour as Google Authenticator.
  • Multi-account: add as many rows as you like; each keeps its own counter and ring. Codes update every second.
  • Storage: nothing is saved to localStorage, cookies, or any server. Refresh the page and the accounts are gone — that's the privacy guarantee.
  • Threat model: anyone who can see your screen can copy the current code, so don't leave the tab open on a shared device. The secret itself is sensitive — treat it like a password.
  • Not a vault. This is a code generator, not a credential manager. For long-term storage use a password manager with a built-in authenticator (1Password, Bitwarden, etc.).