RFC 6238 test vector
With the ASCII secret “12345678901234567890” at unix time 59, the 8-digit SHA-1 code is 94287082.
TOTP Code Generator (2FA)
Generate time-based one-time passwords from a 2FA secret or otpauth link, like an authenticator app.
From the site's 2FA setup page (the text under the QR code).
Result
Enter a secret to see the current code.
Runs in your browser — nothing you enter is sent to a server.
How the TOTP Code Generator (2FA) works
Two-factor apps generate time-based one-time passwords (TOTP, RFC 6238) from a shared secret. Paste the secret shown during 2FA setup (Base32 letters and digits) or the full otpauth:// link, and the tool shows the current code and when it changes — usually every 30 seconds — using your device's clock.
Formulas
Counter
counter = floor(unix time ÷ 30)
Code
code = truncate(HMAC-SHA-1(secret, counter)) mod 106
The HMAC-based one-time password (HOTP, RFC 4226) with the time as counter.
Examples
Testing your own 2FA
Paste a test account's secret to check your server accepts the codes before rolling 2FA out.
Frequently asked questions
Is it safe to paste a real 2FA secret?
It stays in your browser, but a 2FA secret is as sensitive as a password. Only use this for testing or recovery on a trusted device.
Why is my code rejected?
Check your device clock — TOTP depends on accurate time — and that the digits, period and algorithm match the service.
What if I lose my authenticator app?
Use the recovery codes the service gave you at setup; if you saved the secret, you can generate codes here.
Related tools
Password Generator
Create strong random passwords with the length and characters you choose, generated privately in your browser.
Security Tools
HMAC Generator
Generate HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures from a message and secret key.
Security Tools
Unix Timestamp Converter
Convert Unix timestamps to dates in UTC and your time zone, and dates back to timestamps.
Developer Tools