Uttir

TOTP Code Generator

Generate time-based one-time passwords (2FA codes) from a Base32 secret. Same algorithm as Google Authenticator.

TOTP Code Generator — TOTP — Time-based One-Time Password, defined in RFC 6238 — is the algorithm behind the 6-digit codes in Google Authenticator, Authy, 1Password, and every other 2FA app. The codes rotate every 30 seconds (typically) and are derived from a shared Base32 secret plus the current time.

Codes are generated locally in your browser using the Web Crypto API. Your secret is never sent to a server.

What is totp code generator?

TOTP — Time-based One-Time Password, defined in RFC 6238 — is the algorithm behind the 6-digit codes in Google Authenticator, Authy, 1Password, and every other 2FA app. The codes rotate every 30 seconds (typically) and are derived from a shared Base32 secret plus the current time.

This tool generates those codes locally using the Web Crypto API. Paste any Base32 secret (or an otpauth:// URI from a QR code) and watch the code refresh in real time. Nothing leaves your browser.

How to use it

  1. Paste your secret

    A Base32 string (A–Z, 2–7) or a full otpauth:// URI.

  2. Read the code

    The 6-digit code refreshes automatically. Copy it before the timer hits zero.

  3. Use it within the window

    Codes are valid for the period (default 30s). After that, a new one is generated.

Examples

Google Authenticator setup

After scanning a QR code, the service shows a 6-digit code that rotates every 30 seconds.

JBSWY3DPEHPK3PXP

Result: A 6-digit code, e.g. 492 039, with a 30-second countdown.

From an otpauth:// URI

Most QR codes encode a URI that includes the secret and parameters.

otpauth://totp/GitHub:user?secret=JBSWY3DPEHPK3PXP&issuer=GitHub

Result: Same code as above — the URI is parsed and the secret extracted.

Frequently asked questions

Related tools

Password Generator

Create strong, random passwords with custom length and character sets — right in your browser.

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text instantly.

JWT Decoder

Decode a JWT’s header and payload and check its expiration — without sending it anywhere.