TOTP Generator
Paste a base32 secret and watch the 6-digit code refresh every 30 seconds, with a ring that counts down the window. It’s a plain authenticator code online, computed in your browser.
This TOTP generator turns the base32 setup key behind a QR code into the same rotating 2FA code an authenticator app would show. It’s handy when you’re testing a login flow, recovering an account from a saved secret, or just want an OTP secret to code check without reaching for your phone. The code follows RFC 6238 — HMAC-SHA1 over a 30-second counter — and the ring shows how long the current one is valid. Everything happens locally with the Web Crypto API; the secret is never sent anywhere.
How it works
- 1
Paste your base32 secret
Copy the setup key your service shows next to its QR code (letters and digits 2–7) into the secret box.
- 2
Read the live code
The 6-digit code appears immediately and the ring counts down the 30 seconds until it rolls over.
- 3
Copy and use it
Click copy and paste the code into the 2FA prompt before the timer runs out.
Instant & 100% private — nothing is uploaded
Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.
Frequently asked questions
- What secret does this authenticator code online need?
- The base32 string a service gives you when you set up two-factor auth — often shown as “setup key” or “manual entry” under the QR code. It’s made of letters A–Z and digits 2–7.
- Why does the code change every 30 seconds?
- TOTP is time-based: it hashes the secret together with the current 30-second time slot, so a new code appears each window. The countdown ring shows how long the one on screen stays valid.
- Can I use this as a 2FA code generator for logging in?
- Yes, if you have the account’s base32 secret it produces the same codes your phone app would. It’s meant for testing and personal use — treat the secret like a password.
- Does it support 7 and 8-digit codes or SHA-256?
- Yes. Most services use 6 digits and SHA-1, which are the defaults, but you can switch the digit count and hash if your provider uses a different setup.
- Is the secret uploaded anywhere?
- No. The OTP secret to code conversion runs entirely in your browser with the built-in Web Crypto API, so the secret never leaves this tab.
- The code isn’t accepted — what’s wrong?
- Usually a clock issue or a wrong secret. Make sure your device clock is accurate and that you pasted the full base32 key with no missing characters.
More tools
More from the Hivly network
Free sister tools on our other sites.
