What this tool is (and isn't) for
This generates a fresh, throwaway TOTP secret you can scan into any authenticator app to see two-factor codes work in real time — useful for learning, testing, or verifying that your own TOTP implementation produces the same codes as a known-good one. It is not a substitute for how a real service sets up 2FA on your account: when you enable two-factor authentication on an actual account, that service generates its own secret and is the only party that should ever see it. Don't reuse a secret from this tool as if it were issued by your bank, email provider, or any other real account.
How TOTP actually works
TOTP (Time-based One-Time Password, RFC 6238) combines a shared secret with the current time to produce a short-lived code: both your authenticator app and the service you're logging into compute HMAC-SHA1(secret, current_30_second_window) independently, truncate the result to 6 digits, and compare. Because both sides start from the same secret and the same (roughly synchronized) clock, they arrive at the same code without ever communicating during the 30-second window — that's what makes it work offline, unlike an SMS code.
This tool's SHA-1, HMAC-SHA1, and Base32 encoding are implemented directly in JavaScript rather than relying on the browser's Web Crypto API, and were checked against the official published test vectors (RFC 6238 Appendix B for TOTP, RFC 4648 Section 10 for Base32) before this page shipped. The secret itself uses crypto.getRandomValues(), but this tool deliberately refuses to generate secrets outside a secure HTTPS or localhost context — regardless of what any individual API technically permits.
Frequently asked questions
Why 6 digits and a 30-second window?
Both are the most common defaults and what this tool uses, though the RFC allows other digit counts and time steps. 30 seconds balances usability (enough time to read and type the code) against the window an intercepted code would remain valid.
Is this secret as strong as a real service's?
The secret itself is 160 bits of Web Crypto API randomness — the RFC 4226-recommended length. The difference from a real service's 2FA setup isn't the secret's strength; it's that this one is generated for demonstration and never registered with any real account.
Why doesn't the current code get announced automatically for screen readers?
It changes every 30 seconds for as long as this page stays open — automatically announcing that on a timer would talk over anything else you're doing indefinitely. The code has a stable, clearly labeled location instead, so you can navigate to it and read the current value whenever you actually need it.
Why did my authenticator app show a different code than this page?
TOTP only works if both sides agree on the current time — if either your computer's or your phone's clock has drifted (wrong timezone, a device that's been offline a while, manual clock changes), the codes won't match even with the exact same secret. Check that both devices' clocks are correct and set to sync automatically; that resolves the vast majority of mismatches.
Can you see or log the secret?
No — the secret is generated locally and is never included in any network request made by this generator. The QR code is also rendered locally from the secret; nothing about it is sent anywhere either.
Looking to generate a strong password or passphrase to pair with 2FA? Try our Password Generator or Passphrase Generator.
Last reviewed: . Methodology: RFC 6238 TOTP over HMAC-SHA1, implemented in pure JavaScript and verified against the RFC's own published test vectors.