Security & accounts
TOTP Code Generator (Google Authenticator)
Paste a secret key and get the current 6-digit two-factor code, refreshing every 30 seconds — exactly like the Google Authenticator app.
Paste the Base32 key, or the full otpauth:// string from a QR code. Lowercase letters and spaces are fine.
What is TOTP Code Generator (Google Authenticator)?
Time-based one-time passwords (TOTP) are the most widely used form of two-factor authentication today. Once enabled, signing in requires your password plus a six-digit code that changes every 30 seconds — normally read from Google Authenticator, Microsoft Authenticator or Authy on your phone.
This tool does exactly what those apps do, but in your browser. Paste the secret key that the service gave you when you enabled 2FA, and you get the current code along with a countdown to the next refresh. It is useful when you need a code quickly on a desktop, when your phone is not within reach, or when you manage a large number of accounts.
The implementation follows RFC 6238 precisely, using HMAC-SHA1 through the browser's built-in Web Crypto API. Codes match the Google Authenticator app exactly, and you can verify that for yourself by comparing side by side.
How to use
- Get the secret key from whichever service you are enabling 2FA on. Where the QR code appears there is usually a small link like "enter key manually" — that reveals the Base32 string you need.
- Paste it into the secret key field. A full otpauth://totp/... string also works; the tool extracts the key and settings automatically.
- The six-digit code appears immediately, with a progress bar showing how long until it changes.
- Click Copy and paste it into the service's verification field.
- If the service uses 8 digits or a 60-second period (uncommon), adjust the two dropdowns above.
Frequently asked questions
Is my secret key sent anywhere?
No. All computation happens in your browser through the Web Crypto API. There is no server-side processing on this page, and the key you type never leaves your machine. You can confirm this by disconnecting from the internet after the page loads — the tool keeps generating codes.
Why does the code here differ from the one on my phone?
Almost always a clock problem. TOTP derives the code from the current time, so if your computer's clock is off by even half a minute the code will differ. Turn on automatic time synchronisation and try again.
Can this replace the app on my phone entirely?
Technically yes, but you should not. The security value of 2FA comes from the code living on a device separate from the one you sign in with. Entering your password and generating the code on the same computer meaningfully weakens that protection. Treat this as a convenient fallback, not a replacement.
What does a valid secret key look like?
It is a Base32 string containing only letters A through Z and digits 2 through 7, usually 16 or 32 characters long. Lowercase input and spaces are handled automatically. If your string contains other punctuation, you have almost certainly copied something extra by mistake.