OneTaskBy Tim King · Updated
TOTP Generator
RFC 6238 Two-Factor Codes From a Base32 Secret, With a Live Countdown
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the TOTP Generator works
Paste a base32 secret into this TOTP generator and it shows the current two-factor code, refreshing every second, along with the next and previous codes and how long the current one has left. It works with the same secrets Google Authenticator, Authy and 1Password use.
How a TOTP generator turns a secret into a code
TOTP, defined in RFC 6238, is HOTP with the counter replaced by the clock. The current Unix time is divided by the period — 30 seconds by default — to give a step number. That step is signed with HMAC using the shared secret, four bytes are picked out of the signature at an offset given by its last byte, and the result is reduced to six or eight digits. Your phone and the server do the same sum independently, so they agree without ever talking to each other.
Why codes sometimes fail
Almost every TOTP failure is clock drift. If the phone and the server disagree by more than a period, their step numbers differ and so do the codes. Servers usually accept the previous and next step to absorb small drift, which is why this page shows both. The other common cause is a secret copied with a stray space or with the letters O and I in it, which are not valid base32.
When to use this page
Use it to test a 2FA integration you are building, to check a secret from a setup QR code works before you rely on it, or to read a code when your phone is not to hand. Anyone holding the secret can make codes, so treat it like a password.
FAQ
Is SHA-1 still safe for TOTP?
Yes. TOTP uses HMAC-SHA-1, and HMAC does not depend on the collision resistance that broke SHA-1 for signatures. Most authenticator apps only support SHA-1 with six digits and a 30-second period, so change those settings only if the service you are setting up asks for them.
Why does the code change every 30 seconds?
The period is the length of each time step. A short period means an intercepted code is useful for only a few seconds. Thirty seconds is the value nearly every service uses, balancing that against the time it takes a person to read and type the code.
Is my secret sent anywhere?
No. The code is computed with the browser's Web Crypto HMAC on this page and nothing is transmitted. Even so, a TOTP secret is a second password — do not paste production secrets into any page on a shared or untrusted computer.
Where do I find the base32 secret?
Most setup screens offer a "can't scan the code?" link that reveals the secret as text. If you only
have the QR code, decode it — the secret is the secret= parameter inside the otpauth URI it contains.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
HOTP Generator
Counter-based one-time passwords from a base32 secret, listed in a table.
Otpauth URI Decoder
Break an otpauth:// 2FA link into issuer, secret and settings.
Backup Code Generator
Random two-factor recovery codes, grouped for easy reading.
HMAC-SHA256 Generator
Sign a message with HMAC-SHA256 and verify signatures.
Account Security Checklist
A prioritised checklist to secure email, bank, social and work accounts.