TOTP Generator: A Free Online 2FA Code Generator

This is a free online TOTP generator. Paste the Base32 setup key from a service and it shows the current 6-digit code, with no sign-up, computed in your browser, and nothing uploaded.

Plan a trial

Enter your Base32 secret here. It starts with a public demo secret so you can see the tool work.

------

Next code in 30 s

Your secret

Base32 secret (the setup key a service shows, with or without spaces)

1. Time step	-
2. HMAC-SHA1	-
3. Dynamic truncation	-
4. Last six digits	-

What a TOTP code is

A TOTP generator turns a shared secret and the current time into the 6-digit code a service asks for at its second sign-in step. This one is free, needs no account and runs entirely in your browser, so the secret you type never leaves it.

Enter the Base32 setup key. Spaces are accepted, and the code appears with a 30-second countdown.
Defaults. The tool uses HMAC-SHA1, 6 digits and a 30-second step, the defaults nearly every service uses.

How to use it

Find the setup key. When you turn on an authenticator app for an account, the service shows a QR code. Near it is a link such as “Can’t scan it?” or “Enter this key instead”. The text under that link is the Base32 secret, which uses the letters A to Z and the digits 2 to 7.
Paste it into the box. Spaces and lowercase letters are accepted; the tool ignores spaces and reads only A to Z and 2 to 7.
Read the six digits. The code changes every 30 seconds. Type it into the service before the bar runs out, or wait for the next one.
Check the clock if it fails. The code depends on your device’s time. See “Why your code is wrong”.

The tool does not ask for digit count, period or algorithm, because services almost never change them. For a standard Base32 secret, the code matches what an authenticator app shows for the same key at the same second.

Safety: a TOTP secret is a credential

Anyone who holds the secret can produce every future code for that account, from any device, without your phone. For the second factor, the secret is as sensitive as a password.

To confirm this, open your browser’s developer tools, switch to the Network tab, type a secret and watch the list: no request leaves the page. Closing the tab clears the secret.

For everyday sign-ins, use an authenticator app on your phone, not a web page.

The free SSOGEN Authenticator on iPhone and iPad works with any service that supports TOTP and does not require SSOGEN single sign-on. Read about it on the SSOGEN Authenticator page, or see the authenticator app guide.

When a TOTP generator is useful

Situation	Good idea?	Why
Testing an MFA setup you are building	Yes	Compare the code your service expects with an independent calculation, using a test account.
Checking a QR code or setup key a developer produced	Yes	Decode the QR text, copy the secret, and see whether the code matches what the app shows.
Learning how TOTP works	Yes	The four calculation rows show each step. Use the demo secret.
Recovering a code when your phone is dead	Only if you saved the secret	If you stored the setup key somewhere safe when you enrolled, this works as a last resort. Switch to a recovery code or ask the service for a reset afterward, and set up a proper app again.
Everyday sign-in to an important account	No	A web page is a weaker place for a secret than a phone app with a lock screen. You also type a long-lived credential into a browser every time.
Pasting a work or bank secret on a shared screen	No	The screen, a recording or a screen-share can capture the secret.

Why your code is wrong

The service computes the same value from the same secret and the same time, so any mismatch traces back to an input. Most failures have one of five causes.

Symptom	Likely cause	What to do
The code is rejected every time, but a phone app works	Wrong secret or a typo in it	Copy the key again from the service. Letter O and the digit zero are different, and Base32 has no 0, 1, 8 or 9. Only A to Z and 2 to 7 are valid.
The code is rejected only some of the time	Clock drift on this computer	Turn on automatic time in your operating system. Minutes of drift change the code. RFC 6238 recommends accepting at most one step of delay, so a few seconds are tolerated, but not minutes.
The digits are right but the service wants 8	Different digit count	This tool produces 6 digits. If the service shows 8, it is set up outside the defaults.
The code lasts 60 seconds in the service	Different period	This tool uses 30 seconds.
The service named SHA-256 or SHA-512	Different algorithm	This tool uses HMAC-SHA1.
The key has gaps or odd characters	Pasted from a formatted page	Spaces are ignored; other characters are dropped. Check that the key is complete, since a short key gives a wrong code.

If a code worked a moment ago and now fails, you may have submitted it just as the 30-second window rolled over; wait for the next code. Services also refuse a code that was already used.

Self-test: the RFC 6238 test vector

Press Check against the RFC 6238 test vector to prove this page computes TOTP correctly.

RFC 6238, Appendix B publishes test values (read 2026-10-08). For the ASCII key 12345678901234567890 at 59 seconds after the Unix epoch, with the SHA-1 option, the eight-digit code is 94287082.

The button runs your browser’s own HMAC-SHA1 on that input and reports whether the result matches. A pass means your browser’s implementation agrees with the standard; it says nothing about your own secret.

TOTP builds on HOTP, defined in RFC 4226:

RFC 4226 requires a shared secret of at least 128 bits and recommends 160 (section 4, read 2026-10-08).
RFC 6238 replaces the HOTP counter with a count of 30-second steps since 1 January 1970 UTC.
RFC 6238 also tells verifiers not to accept the same code twice (section 5.2).

Questions people ask

Is this TOTP generator really free?

Yes. It costs nothing and needs no sign-up or account. The calculation runs in your browser, so nothing goes to a server.

Can I use it instead of an authenticator app?

You can, but not for everyday use. A phone app keeps the secret behind a device lock, and you never retype it. Use the generator for testing, learning and emergencies.

Where do I get the Base32 secret?

The service shows it next to the QR code when you enable an authenticator app, usually under “Can’t scan it?” or “Enter this key instead”. If you did not save it, reset the second factor in the service.

Why is my 2FA code different from my phone's?

Check the secret, the clock and the settings. Digits, period or algorithm outside the defaults give a different code. The usual cause is a typo in the secret or an incorrect clock.

Where to go next

How the code is made. Read what an authenticator app is and how it works for a step-by-step account.
Other second factors. To compare TOTP with other second factors, see the types of MFA.
Codes on your phone. Get the free SSOGEN Authenticator.
More tools. More browser tools for SSO and identity work are on the free tools page.

Sources, all read 2026-10-09: RFC 6238, RFC 4226.