TOTP / 2FA Code Generator

Generates time-based one-time passwords from a Base32 secret — the same codes Google Authenticator, Authy and Microsoft Authenticator produce. Useful for testing a 2FA implementation or verifying a secret is actually correct before you ship it, all computed locally through the Web Crypto API.

How it actually works

RFC 6238 defines TOTP as HMAC-SHA1 applied to a shared secret and the current 30-second time window, producing a new code every 30 seconds. Both sides — the authenticator app and the server — compute the same value independently from the same secret and the same clock, without any network round trip between them. That's also why TOTP resists replay attacks: a captured code is only valid for the remaining seconds of its window and useless after that.

One warning worth repeating

Never paste a real 2FA secret from a live account into any online tool, this one included — that secret is the entire security of that account, and typing it into a browser tab is functionally the same risk as typing your password into an unfamiliar site. The test key shown here (JBSWY3DPEHPK3PXP) is a publicly documented RFC test vector, meant specifically for testing, not a real credential for anything. If you need to test a live system's TOTP setup, do it on an air-gapped machine or through your actual authenticator app — never through a general-purpose web tool.