Free TOTP and 2FA Code Generator
Generate RFC 6238 TOTP authentication codes in your browser. Free, fast and private, with support for standard Base32 authenticator secrets.
In-Browser RFC 6238 Generator
100% Client-Side • In-Memory Only • Zero Server Logs
Accepts raw 16–64 char Base32 strings (A–Z, 2–7) or complete authenticator QR URIs.
What is a TOTP Code and How Does It Work?
A TOTP (Time-Based One-Time Password) is an algorithm that computes a temporary, dynamic passcode from a shared secret key and the current time. Defined under RFC 6238 by the Internet Engineering Task Force (IETF), TOTP is the security foundation used by leading authentication platforms such as Google Authenticator, Microsoft Authenticator, and 2-step verification systems on Meta, GitHub, and Amazon.
The generation process breaks down into three key steps:
- Time Step Calculation: The current Unix epoch time (in seconds) is divided by a time window (typically 30 seconds) to produce an integer counter value.
- Cryptographic HMAC: The shared Base32 secret key is combined with the time counter using an HMAC hashing function (most commonly HMAC-SHA1, SHA-256, or SHA-512).
- Dynamic Truncation: The resulting hash is truncated dynamically to extract a 6-digit or 8-digit numeric code that remains valid only for that specific time window.
What is a Base32 Secret Key?
When setting up two-factor authentication, services display a QR code or an alphanumeric string. This string is a Base32-encoded secret key(following RFC 4648). Base32 uses only 32 uppercase characters (A–Z and 2–7) to avoid visual confusion between similar characters (such as the number “0” and letter “O”, or number “1” and letter “I”).
You can paste either the clean Base32 string (for example, JBSWY3DPEHPK3PXP) or the full otpauth:// URI provided during two-factor setup into this generator.
TOTP vs. HOTP vs. SMS Authentication
Understanding the security differences between second-factor authentication methods is crucial for protecting business and personal assets:
| Feature | TOTP (RFC 6238) | HOTP (RFC 4226) | SMS Two-Factor |
|---|---|---|---|
| Factor Trigger | Current clock time (30s) | Event / click counter | SMS delivery via carrier |
| Network Requirement | Offline (Client-side) | Offline (Client-side) | Cellular reception required |
| SIM Swap Vulnerability | Immune | Immune | High Risk |
| Phishing Resistance | Moderate (Time-limited) | Low (Code valid indefinitely) | Low (Interceptable) |
Why Is My Authenticator Code Not Working?
If a service rejects the 6-digit TOTP code generated by this tool, check these common causes:
- Device Time Drift: TOTP relies strictly on UTC epoch time. If your computer or phone clock is off by even 30 seconds, the generated code will belong to a past or future time window. Enable automatic network time synchronization in your operating system settings.
- Wrong Secret Key: A single mistyped character in the Base32 string will produce completely different codes without producing a mathematical error. Ensure the full key is pasted without trailing punctuation.
- Algorithm or Period Mismatch: While standard services (Google, Meta, GitHub) use SHA-1 with 30-second intervals and 6 digits, some custom enterprise systems use SHA-256 or 8 digits. Check the tool settings above if needed.
- Time Window Expiration: Copy and enter the code when at least 5–10 seconds remain on the countdown circle to avoid entering an expired code during network transit.
Privacy and Security Architecture
Security and transparency are the foremost priorities of this utility:
Secret keys and generated codes exist exclusively in volatile browser memory. They are never saved to localStorage, sessionStorage, cookies, or IndexedDB.
All HMAC calculations execute through the native browser Web Crypto API. No secret data or authentication tokens are ever sent to our servers or third-party analytics.
Authoritative TOTP & Authenticator Guides
Deepen your understanding of two-factor authentication standards, migration procedures, and security best practices:
What is a TOTP Code? Complete RFC 6238 Guide →
Learn how Time-Based One-Time Passwords operate, from shared secrets to dynamic mathematical truncation.
Authenticator Code Not Working? Troubleshooting Guide →
Step-by-step diagnostic fixes for time drift, invalid secret formats, and mismatched algorithm settings.
TOTP vs. HOTP: Key Differences Explained →
Comparing time-based and counter-based two-factor authentication algorithms, security tradeoffs, and use cases.
Is an Online TOTP Generator Safe? Security Analysis →
Evaluate client-side Web Crypto implementations, network inspection, browser extensions, and physical authenticator apps.
How to Transfer Authenticator to a New Phone Securely →
Official procedures for transferring Google, Microsoft, and Meta 2FA credentials without locking yourself out.
Verified Facebook Business Manager Buying Guide (2026) →
Comprehensive buyer guide for BM1, BM5, and Unlimited DSL verified Meta Business Managers.
How to Prevent Facebook Ad Account Restrictions: Anti-Ban Blueprint →
Practical guidelines on hardware fingerprinting, proxy hygiene, and 2FA authentication to eliminate bans.
Frequently Asked Questions
Answers to common questions regarding TOTP generation and authenticator usage.