TOTP 2FA Authenticator Code Generator

Generate real-time time-based one-time password (TOTP) two-factor authentication codes from Base32 secret keys directly in your browser.

At a glance

TOTP 2FA Authenticator Code Generator is a free browser tool that generates TOTP two-factor authentication codes online. It seamlessly switches between SHA-1 (Google Authenticator standard), SHA-256, and SHA-512 cryptographic digests. Real-time visual progress timer automatically recalculates verification codes at boundary transitions. Nothing is uploaded and no sign-up is needed — everything runs on your device.

Security Suite: TOTP 2FA Generator Token Generator HMAC Generator QR Code Generator Hash Generator Password Generator Hex Encoder

100% Client-Side RFC 6238 / RFC 4226 Execution

All Base32 decoding, HMAC hashing, and OTP token generation occur locally in your browser memory. Your 2FA secrets are never sent over the internet.

Local & Offline
Standard Presets:
LIVE AUTHENTICATOR CODE SHA-1 • 30s Step
------

RFC6238: demo@example.com

Next Refresh: 30s
Interval Step: - -

Google Authenticator standard is SHA-1

Most consumer services use 6 digits

Standard RFC 6238 time step is 30s

| |
Valid Base32 Secret Key (10 bytes / 80 bits entropy)
Length: 16 chars • Clean: 16 chars

Clock Drift Inspector (Window T-1, T, T+1)

Helps debug server clock offset issues
Previous Window (T-1) -
------
Counter: -
Active Window (T) Current
------
Counter: -
Next Window (T+1) -
------
Counter: -

Exportable Authenticator URI (otpauth://)

Render QR Code

You May Also Need

Related Cryptographic & Security Tools

Token Generator

Generate secure CSPRNG API keys, secret bearer tokens & hex keys.

HMAC Generator

Compute HMAC signatures for Stripe, GitHub webhooks & REST APIs.

QR Code Generator

Generate scannable 2FA authenticator QR codes from otpauth URIs.

Hash Generator

Generate SHA-256, SHA-512, MD5, and SHA-1 checksums instantly.

Why Use This TOTP 2FA Authenticator Code Generator?

100% Client-Side Privacy: All Base32 decoding, HMAC hashing, and OTP calculations run in local browser memory with zero network requests.
RFC 6238 & RFC 4226 Compliant: Fully conforms to official time-based and HMAC one-time password standards with dynamic truncation.
Multi-Algorithm Support: Seamlessly switch between SHA-1 (Google Authenticator standard), SHA-256, and SHA-512 cryptographic digests.
Custom Digit Lengths & Periods: Generate standard 6-digit or enterprise 8-digit codes with customizable 30-second or 60-second intervals.
Live Auto-Refresh & Countdown: Real-time visual progress timer automatically recalculates verification codes at boundary transitions.
Clock Drift Inspector: Inspect T-1, T, and T+1 interval windows to diagnose and resolve server authentication clock skew issues.
Exportable Authenticator URI: Live otpauth:// URI builder and parser with reciprocal integration into QR Code Generator.

How to Use TOTP 2FA Authenticator Code Generator

1

Enter Your Secret Key

Paste your Base32 two-factor authentication secret key (e.g. JBSWY3DPEHPK3PXP) or a complete otpauth:// URI into the input field.

2

Select Parameters

Choose the hash algorithm (SHA-1, SHA-256, SHA-512), digit length (6 or 8 digits), and time interval (30s or 60s).

3

Copy the Active 2FA Code

Watch the live countdown timer and click the copy button to grab the active verification code before the window refreshes.

RFC 6238 Vector: SHA-1 8-Digit Code at 59 Seconds

The engine Base32-decodes the secret, packs the counter as 8-byte big-endian, HMAC-hashes it, and applies RFC 4226 dynamic truncation locally.

Example Base32 Secret and Time Source 
Secret (example, not real): JBSWY3DPEHPK3PXP | SHA-1, 8 digits, period 30s, epoch 59s
TOTP Code and Authenticator URI Processed 
Code: 94287082 (counter 1) | otpauth://totp/Test:demo@example.com?secret=JBSWY3DPEHPK3PXP&digits=8&period=30

Technical Specifications & Engine Details

Technical specifications and engine details for TOTP 2FA Authenticator Code Generator
Specification Details
Supported Formats BASE32, OTPAUTH, TEXT → TOTP, OTP, TEXT
Execution Mode 100% Client-Side In-Browser (client)
Browser Requirements Requires modern web browser with Web Cryptography API (SubtleCrypto).
Performance Constraints Client browser memory limit (typically 1–2 GB RAM); processing speed depends on local device CPU.
Maintained by Pragyan Pahadi

100% Client-Side Privacy Guarantee

All HMAC calculations, Base32 decoding, and token generations run 100% locally in your browser memory. No secret keys or authentication data are ever transmitted over the network.

Frequently Asked Questions

What is a TOTP (Time-Based One-Time Password)?
TOTP is an open standardized protocol (RFC 6238) that generates short numeric verification codes using a shared secret key and the current Unix timestamp. It is the core algorithm powering authenticators like Google Authenticator, Authy, and 1Password.
Is it safe to generate TOTP codes in this web tool?
Yes! All HMAC cryptographic calculations and Base32 decoding occur 100% locally inside your web browser. Your secret key is never sent across the internet, logged, or stored on any server.
What Base32 format does this tool require?
The tool accepts standard RFC 4648 Base32 strings containing letters A through Z and digits 2 through 7. Spaces and hyphens are automatically stripped, and lowercase characters are normalized to uppercase.
How do I test for server clock drift?
Use the Time Drift Inspector section below the active code to inspect the previous window (T-1) and next window (T+1) codes. This allows developers to verify whether authentication failures are caused by slight server clock offsets.

Methodology

This tool runs entirely in your browser. The example above shows a representative input and the result it produces.

Last updated .

Recommended Next Steps in Security & QR

View All Security & QR →

Secure API Token & Secret Key Generator

Generate cryptographically secure API tokens, secret keys, Hex digests, and Base64URL secrets using CSPRNG. 100% private in-browser security tool.

Use Secure API Token & Secret Key Generator →

HMAC Signature & Authentication Hash Generator

Compute and verify cryptographic HMAC signatures (SHA-256, SHA-512, SHA-384, SHA-1) in Hex, Base64, and Base64URL formats. 100% private in-browser Web Crypto tool.

Use HMAC Signature & Authentication Hash Generator →

Custom QR Code Generator

Create free, permanent QR codes for URLs, text, Wi-Fi networks, and emails. 100% private in-browser generator with instant PNG and vector SVG download.

Use Custom QR Code Generator →

Cryptographic Hash & Checksum Generator

Compute SHA-256, SHA-512, SHA-384, SHA-1, and MD5 hashes simultaneously for text or local files. 100% private in-browser Web Crypto processing with live checksum matching.

Use Cryptographic Hash & Checksum Generator →

Secure Password Generator

Generate strong, cryptographically secure passwords, memorable passphrases, and PINs in your browser using the Web Crypto API. 100% private with live entropy meter.

Use Secure Password Generator →