Generate time-based one-time codes (TOTP) from your secret — live ticking code, countdown and manual setup details.
Your secret never leaves this browser. This tool shows the code and manual entry details — no QR code is generated. Keep your secret private: anyone with it can generate your codes.
current code
How to use this tool
Copy it from the service's 2FA setup screen (the 'enter manually' option).
The 6-digit code ticks over every 30 seconds, with a countdown.
Type the current code into the service before it expires.
Anyone with the secret can generate your codes — treat it like a password.
Formula & worked example
With the RFC 6238 test secret at 59 seconds past the epoch, the 8-digit code is 94287082 (6-digit: 287082).
Limitations — read this before you rely on it
No QR code is generated — use manual entry or paste the otpauth URL into an app that accepts it. Codes depend on a correct device clock; this tool cannot fix clock skew. It is a convenience viewer, not a replacement for a proper authenticator app for high-value accounts.
Frequently asked questions
No. Codes are computed entirely in your browser with a pure-JavaScript SHA-1/HMAC implementation.
Usually a wrong secret or a skewed device clock. Check both, and remember codes change every period.
This tool uses SHA-1, the default for most authenticator setups. Services that require SHA-256/512 need their own app.
For testing, yes. For real accounts, a dedicated authenticator app on a separate device is safer.
A standard URI that authenticator apps can import — it carries the secret, issuer and period.