CanDoYa
All tools
Saved toolsYour favorites

Add to favorites

Saved in this browser only.
Private browser utility / Developer

Free TOTP Code Generator

Runs entirely in your browser - no upload, no sign-up.

Live workspaceLocal processing
Memory-only session

Your secret is not stored, logged, added to the URL, or sent anywhere. Clear it when you are done.

Base32 input
Required

Spaces and lower-case letters are accepted. The field stays masked unless you reveal it.

Code settings
No QR or export

This page accepts direct text paste only. It does not scan, create, save, or export QR codes or secrets.

Current TOTP codeWaiting for input

Enter a secret to generate a code

Time remaining--

The timer starts after a valid secret.

Reference checkedRFC 6238 compatible

Web Crypto HMAC output is verified against the official SHA-1, SHA-256, and SHA-512 test vectors.

Share this tool
totp code generator / browser utility
01 / Overview

What is a TOTP code generator?

A TOTP code generator turns a shared Base32 secret and the current time into the rotating verification code used by authenticator apps. This page follows RFC 6238 with SHA-1, SHA-256, or SHA-512 and computes the result locally. Your secret stays in memory only and is cleared when you reset or leave.

02

How to use

  1. 01
    Enter the secret

    Type a Base32 setup key or paste an otpauth://totp URI. The secret stays masked by default.

  2. 02
    Match the account settings

    Choose SHA-1, SHA-256, or SHA-512, then select 6 or 8 digits and the correct time period. URI parameters are applied automatically.

  3. 03
    Use the current code

    Copy the code before the countdown reaches zero. A new code appears automatically for the next time step.

  4. 04
    Clear the session

    Select Clear as soon as you finish so the active secret field and generated result are reset.

03

Who it's for

  • Developers and QA teams checking a TOTP integration against a known Base32 test secret.
  • Support engineers confirming that algorithm, digit count, period, and system time agree across two implementations.
  • Account owners using a trusted device for a temporary code when their regular authenticator is unavailable.
  • Security learners exploring how the RFC 6238 time step changes a code without sending the secret to a server.

This generator accepts a Base32 secret or a standard otpauth://totp setup URI, then uses your browser's native Web Crypto engine to calculate the current code. It makes no request with your input, writes nothing to browser storage, and never puts the secret in the page URL. For real accounts, use a trusted authenticator or password manager as your everyday vault and treat this page as a temporary recovery, testing, or interoperability aid.

QR handling is deliberately out of scope: the tool does not upload screenshots, open a camera, create a QR code, or export a setup URI. That keeps the secret's exposure surface small; use your authenticator's trusted provisioning flow when a QR code is required.

FAQ

Is my TOTP secret uploaded or stored?

No. The secret is processed by the Web Crypto API in your browser and is never submitted to a server, written to localStorage, placed in the URL, or logged by the tool. It remains in page memory until you select Clear, close the tab, or navigate away.

Is this TOTP code generator free?

Yes. It is free to use with no account, download, or usage limit. The page can keep generating codes after it has loaded because the algorithm and clock run locally in your browser.

What TOTP settings are supported?

The generator supports HMAC-SHA-1, HMAC-SHA-256, and HMAC-SHA-512, with 6 or 8 digits and 30 or 60 second periods in the interface. It accepts unpadded or correctly padded RFC 4648 Base32 secrets and standard otpauth://totp setup URIs.

Why does my 2FA code not match my authenticator app?

Check that both devices have accurate system time and use the same algorithm, digit count, and period. Most accounts use SHA-1, 6 digits, and 30 seconds. A mismatch in any setting, or a secret copied with the wrong character, produces a different code.

Can I paste an otpauth URI?

Yes. Paste a standard otpauth://totp URI and the tool reads its secret, algorithm, digits, and period in memory. HOTP URIs are rejected because HOTP uses an event counter rather than time. The URI is never saved or exported.

Does this tool scan or generate 2FA QR codes?

No. QR upload, camera scanning, QR creation, and secret export are deliberately excluded. Direct text paste is easier to inspect and avoids keeping a sensitive QR image or downloadable setup artifact. Use your authenticator's trusted provisioning flow when a QR code is required.

Is an online TOTP generator safe for a real account?

A browser-local generator avoids sending the secret to a server, but the secret is still a long-lived credential. Use only a device and browser you trust, avoid extensions you do not trust, clear the field afterward, and prefer a dedicated authenticator or encrypted password manager for routine use.