TOTP Generator: Compute 2FA Codes from a Base32 Secret

How to use the totp generator

1. Paste your Base32 secret into the Base32 secret field. Spaces are stripped automatically.
2. Choose the number of digits (6 or 8) and the period in seconds (usually 30).
3. Select the hash algorithm. Most authenticator apps use SHA-1 by default.
4. Optionally enter a specific Unix time to reproduce test vectors or debug past codes.
5. Read the generated code, the remaining seconds in the current window, and the upcoming code.

How TOTP works under the hood

TOTP (Time-based One-Time Password) extends HOTP by replacing the event counter with a time step. The algorithm defined in RFC 6238 computes a counter value as C = floor(T / period), where T is the Unix time in seconds. That counter is encoded as an 8-byte big-endian integer and passed to HMAC along with the shared secret.

The HMAC output is then truncated per RFC 4226. Take the last nibble of the hash as an offset, read four bytes starting at that offset, mask the high bit, and take the result modulo 10^digits. For example, with the RFC 6238 SHA-1 test secret 12345678901234567890 (Base32: GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ), at time 59 the counter is floor(59/30) = 1. The 8-digit code produced is 94287082, and the 6-digit truncation is 287082.

RFC 6238 test vectors reference

Use these known values to verify any totp calculator or authenticator implementation. The SHA-1 secret is the ASCII string 12345678901234567890 encoded in Base32. The SHA-256 secret repeats that string to 32 bytes, and the SHA-512 secret repeats it to 64 bytes.

Setting the period to 1 second and the time to 0 turns this totp generator into an HOTP tool. With counter 0, the SHA-1 secret above yields the RFC 4226 code 755224.

Practical uses for a TOTP code generator

Developers building two-factor authentication need a reliable 2fa code generator to test their server-side verification logic without scanning QR codes into a phone every time. By entering the same Base32 secret your backend stores, you can instantly produce matching codes to assert against.

Security auditors also use tools like this to confirm that applications follow RFC 6238 correctly, including proper handling of clock drift and time-step boundaries. If you work with financial identifiers such as those checked by a credit card checker or an iban checker, pairing them with strong TOTP-based two-factor authentication adds a critical layer of account security.

Common mistakes when generating TOTP codes

The most frequent error is providing a hex-encoded secret instead of Base32. Authenticator apps expect RFC 4648 Base32. Another common issue is clock skew: if your device clock drifts more than half a period away from the server, the codes will not match. Most servers allow a window of one step before and after the current time to compensate.

Using the wrong hash algorithm is another pitfall. While SHA-1 remains the default for most services, some modern systems require SHA-256 or SHA-512. Always check the provisioning URI or documentation. Finally, never paste a live production secret into any online tool. Although this totp generator processes everything locally in your browser, copying secrets carelessly increases exposure risk.

Base32 encoding and secret formatting

TOTP secrets are typically shared as Base32 strings because they avoid visually ambiguous characters found in Base64, such as 0 vs O or 1 vs l. The alphabet consists of A-Z and 2-7. Padding with = is optional and usually omitted in authenticator URIs.

This tool strips spaces and padding automatically, so you can paste formatted secrets directly. Under the hood, the Base32 string is decoded into raw bytes, which become the key for the HMAC function. If the input contains characters outside the Base32 alphabet, the totp generator returns an error rather than producing an incorrect code silently.

Worked examples