Compute the current TOTP/2FA code (RFC 6238) from a Base32 secret or an otpauth URI - fully local, the secret never leaves your device.
Running locally on your device ...
Running locally on your device ...
0%
Your files never left your device
No. Everything runs in your browser - your file never leaves your device. How this is verifiable
A TOTP code (Time-based One-Time Password, RFC 6238) is the short number authenticator apps like Google Authenticator or Authy show for two-factor sign-in. It comes from a secret key (usually encoded as a Base32 string) and the current time: the service and your app both know the same key and independently compute the same code for the same time step (typically 30 seconds) - there is no communication between server and app at all, only a shared formula.
This tool computes exactly that formula locally in your browser. You either paste a complete otpauth:// URI, the kind usually hidden inside a QR code when setting up a new 2FA account, or enter the secret manually and choose the algorithm (SHA-1, SHA-256 or SHA-512), digit count (6, 7 or 8) and time window (default 30 seconds) yourself. If a pasted otpauth URI already carries one of these values, it wins - exactly like a real setup flow in any authenticator app.
What this is good for: if you lose your phone or switch authenticator apps, you can use the saved secret here to immediately check that it is still correct, without installing a new app first. It is also handy while building your own 2FA integration, to quickly compute the expected code and compare it against your own server.
The secret is the entire security of your 2FA account - anyone who knows it can compute every future code. That is exactly why the computation runs entirely locally via the browser native Web Crypto interface (HMAC via crypto.subtle), nothing is ever sent, stored or logged, and the tool keeps working offline after the first load. To turn a freshly created secret into a QR code, use our QR code generator: just paste the otpauth URI into it.
| Input formats | Text input |
|---|---|
| Output format | TXT |
| Batch processing | No |
| Processing | Locally in your browser (JavaScript) |
| File upload | None |
Limitations: This tool does not scan QR codes via camera (deliberately left out for privacy) - the secret or otpauth URI must be entered as text. It stores no secrets between visits; everything is gone once you close the page. HOTP (the counter-based variant with no time component) is deliberately not supported, only TOTP. To turn a freshly generated secret into a QR code, use the separate QR code generator with the otpauth URI shown here.
No. The computation runs entirely locally in your browser via Web Crypto; the secret never leaves your device, is not stored and is not logged.
TOTP derives the counter from the current time (a 30-second window by default), HOTP from a running event counter. Almost all authenticator apps today use TOTP; this tool deliberately supports only that variant.
Yes, indirectly: paste the otpauth URI (with secret, algorithm, digit count and time window) into our QR code generator - it turns it into a scannable code for any authenticator app.
SHA-1 (the standard almost every app uses), SHA-256 and SHA-512 - all three via the browser native Web Crypto HMAC function, no extra library.
TOTP codes are only valid for a fixed time window (usually 30 seconds). Once it expires, clicking generate again automatically computes the next valid code.
QR code generator · Password generator · Calculate an HMAC · BIP39 generator · UUID generator