TOTP 2FA Generator

TOTP (Time-based One-Time Password) is an algorithm that generates temporary authentication codes based on a shared secret and the current time. In a typical 2FA setup, the server and the user's authenticator app both store the same secret key. Every 30 seconds, a new 6-digit code is generated from the secret and the current Unix timestamp. During login, the user enters this code and the server verifies it by generating the same code independently. This adds a second layer of security beyond passwords because an attacker would need both the password and physical access to the authenticator device to log in.

Yes, absolutely. The secret keys generated by this tool are Base32-encoded and fully compatible with Google Authenticator, Authy, Microsoft Authenticator, Duo Mobile, and any other authenticator app that supports the TOTP standard (RFC 6238). You can either scan the QR code directly in your authenticator app or manually enter the Base32 secret key. The codes generated by our tool will match your authenticator app exactly when using the same secret and parameters.

TOTP codes are calculated using the HMAC-based One-Time Password (HOTP) algorithm with the current time as the counter value. Specifically, the Unix timestamp is divided by the time period (usually 30 seconds) to produce a counter. The shared secret key is then used with HMAC-SHA1 (or SHA-256/SHA-512) to generate a hash, which is dynamically truncated to produce a 6 or 8 digit code. The entire process is deterministic — given the same secret and the same time, any TOTP implementation will produce the identical code, which is what makes the system work across different apps and servers.

For testing and educational purposes, yes. Our TOTP generator performs all cryptographic operations locally in your browser using the Web Crypto API. Secret keys are never transmitted to any server, stored in any database, or logged in any way. You can verify this by checking your browser's network tab while using the tool. However, for production use, you should generate your actual 2FA secrets using your server's secure key generation infrastructure or your authenticator app directly, as browser-based generation may not provide the same level of entropy and security as dedicated cryptographic hardware.

The most common reason for TOTP code mismatches is clock synchronization between the server and the authenticator device. TOTP algorithms rely on both parties having synchronized Unix time — even a few seconds of drift can cause mismatches because the code changes every 30 seconds. Other possible causes include using the wrong secret key, different hash algorithms (SHA-1 vs SHA-256), different digit lengths (6 vs 8), or different time periods. Ensure both your TOTP generator and authenticator app use identical parameters and that your device clock is accurate. Most authenticator apps automatically synchronize time using NTP servers.