Paste a base32 secret to see its live 2FA code and countdown, or generate a new secret with a scannable QR code for your authenticator app. Everything runs locally — your secret never leaves your device.
Files never leave your device
Get a code
Set up a new secret
What This Tool Does
This tool works with TOTP (Time-based One-Time Password) secrets, the codes behind most authenticator apps. Paste an existing base32 secret to see its live 6-digit code with a countdown, or generate a brand-new secret complete with an otpauth:// URI and a scannable QR code ready for Google Authenticator, Authy, or any compatible app.
Everything happens on your device. Whether you're checking a code or minting a fresh secret, nothing is uploaded — the whole point of TOTP is that both sides can generate matching codes without any network round-trip, and this tool works the same way.
What Is TOTP / Two-Factor Authentication
TOTP adds a second proof of identity on top of a password: something you have (a secret stored in an authenticator app) rather than something you know. Both your device and the service you're logging into hold the same secret; each independently combines it with the current time to produce a matching 6-digit code, so a stolen password alone isn't enough to log in.
Tip:The code changes because time is one of the two ingredients — this means your device's clock needs to be reasonably accurate. If codes never seem to match no matter how carefully you type them, check that your system clock is synced before assuming the secret is wrong.
Getting a Live Code
Paste a base32 secret into the field and the tool immediately shows the current 6-digit code along with a countdown to the next refresh. This is useful for confirming a secret works, recovering access when you have the raw secret but not the original QR code, or just checking a code without reaching for your phone.
Setting Up a New Secret
Fill in an account label and issuer name, then generate a fresh, randomly generated secret. You get three things back: the raw base32 secret (for manual entry), the full otpauth:// URI, and a QR code encoding that URI — scan it with your authenticator app's "add account" flow and it's set up immediately, showing the same rotating codes the tool displays.
SHA1 is the near-universal default for TOTP and is what almost every authenticator app expects — stick with it unless a specific service tells you otherwise. SHA256 and SHA512 are also available for services that specifically request them. Six digits and a 30-second period match the RFC 6238 standard and are what most authenticator apps assume, so change them only if the service you're setting up explicitly documents different values.
Your Secret Never Leaves Your Device
Both generating a new secret and computing a live code from an existing one run entirely inside a WebAssembly module in your browser. There's no account, no server round-trip, and no storage — the time comes from your own device's clock, and the secret exists only in this page's memory for as long as the tab stays open.
If you need to decode or verify a JWT, see the JWT decoder & verifier. If you need a fresh public/private key pair for signing or SSH, see the Key pair generator — both run on-device the same way this tool does.
Frequently asked questions
Is my secret uploaded anywhere?
No. Every code is computed locally using WebAssembly running inside your browser tab. Whether you paste an existing secret or generate a new one, it never travels over the network — closing the tab clears it, since there was never a server involved.
What's the QR code for?
It encodes the same otpauth:// URI as a scannable image, which is the fastest way to load a secret into a phone-based authenticator app. Open Google Authenticator, Authy, or a similar app, choose add account by scanning a QR code, and point your camera at it — the app then generates the same rotating codes this tool shows you.
Why is my code different from the one in my authenticator app?
The most common cause is clock skew — TOTP codes are derived from the current time, so if your computer's or phone's clock has drifted, the codes won't line up until it resyncs. The other common causes are a mismatched secret (make sure you copied the whole base32 string), or different algorithm, digit count, or period settings between the tool and the app generating the code.
Is TOTP the same as the one-time codes my bank texts me?
No, those are different mechanisms. TOTP (this tool) generates codes from a secret already stored on your device — no network round-trip is needed to get a new code, and nothing is sent to you each time. SMS one-time passwords are a separate system where a code is generated server-side and delivered to your phone number over text message, which has its own well-known weaknesses like SIM-swapping.
What is the base32 secret, exactly?
It's the shared key that both your authenticator app and the service you're logging into use to generate the same codes independently, encoded in base32 (letters and digits, no padding characters needed) so it's easy to type or read aloud. Anyone who has this secret can generate valid codes for the account, which is why it's shown once during setup and should be kept private, the same way you'd treat a password.
Why 30 seconds and 6 digits?
That's the near-universal default defined by the TOTP standard (RFC 6238): a new 6-digit code every 30 seconds, computed from the secret and the current time. It's a practical balance — long enough that you have time to type the code before it expires, short enough that a leaked code becomes useless within half a minute. Some services use different digit counts or periods, which is why this tool lets you configure both.
Does this tool store or remember my secret?
No. There's no local storage, cookie, or account behind this tool — refresh the page or close the tab and the secret is gone from memory entirely. If you're setting up a new account, save the secret or the QR code somewhere safe (like your password manager) before you navigate away, because this tool won't have it the next time you open it.