LocalToolsOffline browser tools collection

Category: Developer tools

TOTP Generator

System ideaMissing a tool?

Generate time-based 2FA codes locally from a Base32 secret

Paste a Base32 secret or an otpauth://totp/... URI to generate the same 6- or 8-digit time-based one-time password your authenticator app would show. Runs entirely in your browser.

Paste a Base32 secret, or a full otpauth://totp/... URI to fill in the algorithm, digits and period automatically.

Current code
The result will appear here.

Everything runs in your browser: the secret is never sent anywhere, and nothing is stored once you leave the page.

Everything on this page is processed in your browser. Nothing is uploaded.

What this tool does

TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind most authenticator apps: a shared secret and the current time, hashed together with HMAC and truncated to a short code, produce a new value every 30 seconds without either side ever talking to the other. This tool runs the same computation locally using the Web Crypto API, so you can check a secret, debug an integration, or generate a code without installing an app.

How to use it

  1. Paste the Base32 secret from your 2FA setup, or the full otpauth://totp/... URI from a QR code payload.
  2. If you pasted a bare secret, set the algorithm, digit count and time step to match what the service issued.
  3. Read the current code before it expires, and copy it with one click.

Privacy

This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.

Frequently asked questions

Is my secret sent anywhere?
No. The code is computed with the Web Crypto API running in your browser tab; the secret you paste never leaves your device.
Why does pasting an otpauth:// URI hide the algorithm and digit fields?
The URI already carries the algorithm, digit count and time step, so this tool reads them from the link instead of asking you to re-enter values that must match exactly.
Which algorithm and digit count should I use?
Match whatever the service that issued the secret uses. Most consumer apps use SHA-1 with 6 digits and a 30-second step; this tool defaults to that but supports SHA-256, SHA-384 and SHA-512, and 6 or 8 digits.

Back to all tools