TOTP code generator (2FA)

Generate the temporary verification code (TOTP, RFC 6238 compliant) from the Base32 secret a service gives you when you enable two-factor authentication, with a countdown to the next renewal. The secret you enter and the calculation stay entirely in your browser — nothing is sent to a server.

Example:
The secret provided when you scanned the QR code (often shown as text below it).

How it works

TOTP (Time-based One-Time Password) is the mechanism used by most two-factor authentication apps (Google Authenticator, Authy, etc.): from a shared secret and the current time split into fixed periods (30 seconds by default), a numeric code is regularly recalculated according to RFC 6238. This code renews automatically every 30 seconds.

Is it safe to paste my 2FA secret here?

The calculation runs entirely in your browser, with no network calls: your secret never leaves your device. That said, a TOTP secret is sensitive information, equivalent to a password: avoid leaving it displayed or sharing it, and for everyday use prefer a password manager or a dedicated authenticator app over a web tool like this one, which is best kept for debugging or occasional use.

Why doesn't my code match the one in my app?

The most common cause is a clock offset on your device: TOTP depends closely on the system time. Also check that the number of digits and the period match those configured by the service (6 digits / 30 seconds in the vast majority of cases).

Privacy: the secret and the code calculation stay 100% local in your browser (WebAssembly) — nothing is sent to a server, not even temporarily.