TOTP Authenticator Code Generator

Generate time-based one-time passcodes (RFC 6238) from a Base32 secret, with a live countdown and code verification. Runs locally with Web Crypto.

How it works

• The secret is decoded from Base32 (RFC 4648) into raw bytes — spaces and hyphens are ignored, and lowercase is accepted.
• The current Unix time is divided into 30-second steps; the step number becomes an 8-byte big-endian counter.
• HMAC-SHA1 is computed over that counter with the decoded secret, then a 31-bit number is extracted from the digest (dynamic truncation) and reduced modulo 1,000,000 to give the 6-digit code.
• The countdown shows how long the displayed code stays valid; the code is recomputed every second with Web Crypto, entirely in your browser.

About TOTP

TOTP (Time-based One-Time Password) is a one-time password derived from a shared secret and the current time, standardized in RFC 6238. It is built on the same HMAC-SHA1 construction as HOTP (RFC 4226), but instead of a moving event counter it uses a 30-second time step as the moving factor, so each code is valid only for that window. The code is the low 6 digits of a dynamically truncated HMAC-SHA1 over the time-step counter — change the secret or the time, and the code changes completely.

Use TOTP for two-factor authentication (2FA) — authenticator apps such as Google Authenticator, 1Password, and Authy all speak TOTP — and for any service where a shared secret can be provisioned safely, including password-manager accounts. Because the code depends on time, the device must keep its clock synchronized: if codes keep failing, check the system time before suspecting the secret. The Base32 secret is the root of trust: provision it over a trusted channel, back it up securely (for example, as a recovery code), and treat it like a password — anyone who obtains it can generate every future code. Real-world verifiers often accept ±1 step to absorb clock drift; this page checks only the current step.