# TOTP Code Generator

> Generate time-based one-time passwords (2FA codes) from a Base32 secret. Same algorithm as Google Authenticator.

URL: https://uttir.com/totp-generator
Categories: security-tools, developer-tools
Privacy: Codes are generated locally in your browser using the Web Crypto API. Your secret is never sent to a server.

## About

TOTP — Time-based One-Time Password, defined in RFC 6238 — is the algorithm behind the 6-digit codes in Google Authenticator, Authy, 1Password, and every other 2FA app. The codes rotate every 30 seconds (typically) and are derived from a shared Base32 secret plus the current time.

This tool generates those codes locally using the Web Crypto API. Paste any Base32 secret (or an otpauth:// URI from a QR code) and watch the code refresh in real time. Nothing leaves your browser.

## How to use

1. **Paste your secret** — A Base32 string (A–Z, 2–7) or a full otpauth:// URI.
2. **Read the code** — The 6-digit code refreshes automatically. Copy it before the timer hits zero.
3. **Use it within the window** — Codes are valid for the period (default 30s). After that, a new one is generated.

## Examples

### Google Authenticator setup

After scanning a QR code, the service shows a 6-digit code that rotates every 30 seconds.

Input:

```
JBSWY3DPEHPK3PXP
```

Output:

```
A 6-digit code, e.g. 492 039, with a 30-second countdown.
```

### From an otpauth:// URI

Most QR codes encode a URI that includes the secret and parameters.

Input:

```
otpauth://totp/GitHub:user?secret=JBSWY3DPEHPK3PXP&issuer=GitHub
```

Output:

```
Same code as above — the URI is parsed and the secret extracted.
```

## FAQ

### Is this the same as Google Authenticator?

Yes. It uses the same RFC 6238 algorithm (HMAC-SHA1, 30-second window, 6 digits by default) and the same Base32 secret format, so the codes match exactly.

### Is my secret sent anywhere?

No. The HMAC-SHA1 calculation runs in your browser using the Web Crypto API. Your secret is never transmitted. Close the tab and it is gone.

### What if my code does not match my authenticator app?

Check the system clock on your device — TOTP requires it to be within about 30 seconds of the server's. Also confirm the secret is correct and that you are using the same number of digits and period.

### Can I use this instead of an authenticator app?

For testing and recovery, yes. For daily use, an authenticator app is better — it backs up your secrets, supports multiple devices, and locks them behind device-level authentication.

## Related tools

- [Password Generator](https://uttir.com/password-generator) — Create strong, random passwords with custom length and character sets — right in your browser.
- [Hash Generator](https://uttir.com/hash-generator) — Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text instantly.
- [JWT Decoder](https://uttir.com/jwt-decoder) — Decode a JWT’s header and payload and check its expiration — without sending it anywhere.

---

For the full HTML page with the live tool, visit https://uttir.com/totp-generator.
This file is the markdown rendering at https://uttir.com/totp-generator.md. See https://uttir.com/llms.txt for a site-wide summary.