How to use the TOTP 2FA Code Generator
1. Enter the base32 secret key (shown when setting up 2FA in apps like Google Authenticator).
2. Leave period at 30s and digits at 6 unless your service uses different settings.
3. Click Start to generate a live TOTP code that refreshes every period. All computation is in your browser.
What is it?
TOTP (Time-based One-Time Password) is defined in RFC 6238 and is the algorithm behind Google Authenticator, Authy, and most 2FA apps. It computes HMAC-SHA1 of a counter (current time ÷ period) keyed with the shared secret, then extracts a 6–8 digit code from the result.
The shared secret is typically presented as a base32 string when setting up 2FA. This tool uses WebCrypto HMAC-SHA1 — identical to what Google Authenticator does — so the codes it generates will match.
Benefits
Verify data integrity instantly
Hash comparison confirms whether a file, API response, or downloaded binary has been altered in transit or at rest — without storing the original content.
Authenticate requests and webhooks
HMAC signatures prove a request came from a trusted source and was not modified in transit — the mechanism behind Stripe, GitHub, and AWS webhook security.
Protect sensitive data at rest
AES-256 encryption makes stored content unreadable to anyone without the key — even if your database, S3 bucket, or file system is fully compromised.
Generate credentials that meet security standards
Cryptographically random output from the Web Crypto API satisfies NIST entropy requirements — unlike predictable Math.random()-based alternatives.
Frequently asked questions
Where do I find the base32 secret?
When adding 2FA in most services (GitHub, Google, etc.), they show a QR code AND a text backup code. The text code is the base32 secret. It's usually labelled 'manual entry key' or 'secret key'.
Is it safe to enter my real 2FA secret here?
All computation happens in your browser — nothing is transmitted. However, for production secrets, use an authenticator app instead. This tool is designed for testing and development.