Generators

TOTP Generator

Generate time-based one-time passwords (TOTP) from a base32 secret or an otpauth:// URI. The tool implements RFC 6238 and supports SHA-1, SHA-256, and SHA-512 algorithms with configurable digit count (6 or 8) and time step (usually 30 seconds). Shows the current code with a countdown to the next refresh.

TOTP Generator — Generate time-based one-time passwords (RFC 6238) from a base32 secret or otpauth URI

What it does

  • ▸Generates TOTP codes from a base32 secret or otpauth:// URI
  • ▸Supports SHA-1, SHA-256, and SHA-512 algorithms
  • ▸Configurable digits (6 or 8) and time step (default 30 seconds)
  • ▸Parses otpauth:// URIs to extract secret, issuer, account, and parameters
  • ▸Shows a live countdown to the next code refresh

Use cases

  • ▸Generating a 2FA code for testing an authentication flow
  • ▸Verifying that a TOTP secret produces correct codes for a user setup
  • ▸Debugging otpauth:// URIs from QR codes to check their parameters
  • ▸Testing TOTP with non-standard algorithms (SHA-256, SHA-512)

How it works

1

Paste your base32 secret or otpauth:// URI into the input

2

The tool decodes the secret and computes the current TOTP code

3

A countdown shows when the next code will be generated

4

The code updates automatically when the time step expires

Frequently asked questions

1What's an otpauth:// URI?

It's the standard format for encoding TOTP configuration in QR codes, used by Google Authenticator, Authy, and other 2FA apps. It includes the secret, issuer, account name, algorithm, digits, and period. Example: otpauth://totp/Example:ada@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example

2Why does my code not match my authenticator app?

The most common cause is a time sync issue — TOTP relies on the current time being accurate. Other causes: wrong algorithm (some apps only support SHA-1), wrong digit count, or wrong time step. Check that your system clock is synced with an NTP server.

3Is it safe to use this for my real 2FA secrets?

The tool runs locally and doesn't transmit your secret. However, for production 2FA, use a dedicated authenticator app on your phone. This tool is designed for testing and debugging, not as your primary 2FA app.

Related tools

Basic Auth Generator — Build or decode an HTTP Basic Authorization header from user:password

Basic Auth Generator

Build or decode an HTTP Basic Authorization header from user:password

JWT Debugger — Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

JWT Debugger

Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

Hash Generator — MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Hash Generator

MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Password Strength — Estimate password entropy, weaknesses and crack time

Password Strength

Estimate password entropy, weaknesses and crack time

Use TOTP Generator offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →