Free TOTP / Authenticator Code Generator

TOTP (Time-based One-Time Password) generates 6-digit codes that change every 30 seconds, used for two-factor authentication.

Yes — the secret never leaves your browser. All computation is done locally.

Yes, completely free.

Yes, the TOTP / Authenticator Code Generator is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the TOTP / Authenticator Code Generator in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The TOTP / Authenticator Code Generator works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

The most common cause is a clock difference: TOTP combines your secret with the current time, so if this device or your phone is even a few seconds off, the generated code can lag or jump ahead. Make sure both devices use automatic, network-synced time. The second common cause is the secret itself — a mistyped, truncated, or wrong-format Base32 key produces valid-looking but incorrect codes. This generator helps you isolate the problem because it shows the previous, current, and next codes side by side, so a code that is merely one 30-second step out of sync is easy to spot. Paste your exact Base32 secret here and compare all three codes with your app; if none line up, the secret is the issue, not the timing.

A Base32 secret is just the raw key a service shows when you pick "enter setup key manually" — a short string of letters and digits like JBSWY3DPEHPK3PXP. An otpauth:// URI is the full provisioning string encoded inside a 2FA QR code; it wraps that same secret together with extra metadata such as the issuer (service name), the account label, and sometimes the digit count and time step. Both ultimately carry the same secret, so either one is enough to generate codes. This tool accepts both: type the Base32 key directly, or paste the entire otpauth:// URI and click Parse to extract the secret while also reading out the issuer and account. Use whichever form your service hands you and the generator does the conversion for you.

Authentication servers rarely accept only the exact current code. To forgive small clock drift and the seconds between reading a code and submitting it, most servers also accept a code from the adjacent 30-second window. Showing the previous (expired) and next (upcoming) codes makes that tolerance visible: if a login accepts a code that looks one step behind, you can see exactly why. It also makes debugging easier — when this generator and your authenticator app disagree by a single step, the matching value is usually sitting right there in the previous or next slot, confirming the secret is correct and only the timing is slightly off. Paste your secret and watch all three codes roll over together as the countdown bar reaches zero.

By default a TOTP code is valid for one 30-second time step, which is the interval virtually every authenticator app and service uses. Because the window is anchored to absolute clock time rather than when you opened the page, codes change on the half-minute boundary — not exactly 30 seconds after you start looking — so the time remaining on a fresh code can be anywhere from 1 to 30 seconds. This generator uses the standard 30-second step and shows a live countdown bar that turns amber and then red as expiry nears, so you always know whether to use the current code immediately or wait for the next one. When the bar empties, the code refreshes automatically. Open the tool to see the countdown and grab a code while it is still fresh.

Yes, for the standard case. It implements RFC 6238 exactly as the major services expect: 6-digit codes, a 30-second time step, HMAC-SHA1 hashing, and RFC 6238 dynamic truncation, all computed in your browser with the Web Crypto API. As long as you supply the correct Base32 secret and your device clock is accurate, the codes it produces are identical to those from Google Authenticator, Authy, or Microsoft Authenticator. The caveat is non-default setups: a handful of services use SHA-256, SHA-512, 8 digits, or a different time step, and those will not match here. Treat it as a way to verify or temporarily recover access, not a replacement for securely storing your secret. Paste your secret to confirm your codes line up before you rely on them.