TOTP / 2FA Code GeneratorMembers

A TOTP (Time-based One-Time Password) is the 6-digit code an authenticator app shows for two-factor authentication. It's derived from a shared secret and the current time, so it changes every 30 seconds and can be verified without any network round-trip.

Either the Base32 secret key a service gives you (letters A–Z and digits 2–7, spaces are ignored), or a full otpauth://totp/... URI — the same string encoded in a setup QR code. If you paste a URI, the secret, digit count and period are read from it automatically.

Yes. It implements the standard RFC 6238 algorithm (HMAC-SHA1, 6 digits, 30-second period) that Google Authenticator, Authy, Microsoft Authenticator, 1Password and most other apps use, so the codes match exactly.

The code is computed from a time counter equal to the current Unix time divided by the period (30 seconds by default). Each time that counter ticks over, a fresh code is produced and the old one expires — that's what makes it a one-time password.

Everything runs locally in your browser using the built-in Web Crypto API — your secret is never sent anywhere and we never see it. That said, for your real accounts a dedicated authenticator app on your phone is the safer place to store secrets long-term. This tool is best for testing, recovery and development.

The most common cause is a clock that's out of sync: TOTP relies on accurate time, so check your device's clock is set automatically. Also confirm the digit count and period match what the service expects, and that the secret was copied in full.