BYTETOOLS

TOTP Code Generator

Generate live TOTP two-factor codes from a Base32 secret with a countdown, previous and next windows, and a ready-made otpauth:// enrolment URI.

What is the TOTP Code Generator?

A TOTP generator turns a shared Base32 secret and the current time into the six-digit code an authenticator app would show. It HMACs the 30-second time counter with the secret and truncates the result to the required number of digits.

  • Live 6 or 8-digit codes with a per-second countdown
  • SHA-1, SHA-256 and SHA-512 HMAC options
  • Previous and next window codes shown for clock-drift debugging
  • Random 160-bit Base32 secret generator
  • otpauth:// enrolment URI ready to turn into a QR code
  • Fixed-time mode for reproducing RFC 6238 test vectors

How to use the TOTP Code Generator

  1. 1

    Paste the Base32 shared secret, or click Generate to create a random one.

  2. 2

    Match the algorithm, code length and period to what the service expects — usually SHA-1, 6 digits, 30 seconds.

  3. 3

    Read the current code and watch the countdown bar for the remaining validity.

  4. 4

    Fill in the issuer and account name to build a matching otpauth:// URI.

  5. 5

    Turn on fixed time if you want to reproduce a specific code for a given Unix timestamp.

About the TOTP Code Generator

The ByteTools TOTP Code Generator produces the same time-based one-time passwords that Google Authenticator, Authy and 1Password show. Paste the Base32 secret from a setup screen and the current code appears immediately, with a countdown bar and the previous and next windows so you can see the rollover.

It implements RFC 6238 exactly: the secret is Base32-decoded, the Unix time divided by the period becomes an 8-byte counter, that counter is HMACed with SHA-1, SHA-256 or SHA-512, and dynamic truncation yields a 6 or 8-digit code. A fixed-time mode lets you reproduce the RFC's published test vectors.

Everything is computed locally with the Web Crypto API — the secret never leaves your browser and is not stored. Because of that, treat this as a testing, debugging and recovery tool rather than a replacement for a dedicated authenticator app on a separate device.

Frequently asked questions

What is a TOTP code?

It is a one-time password derived from a secret you and the service both know plus the current time, usually valid for 30 seconds. Because the time changes, the code changes, and an attacker who sees an old code learns nothing useful.

Where do I find my Base32 secret?

When a service shows you a 2FA QR code there is almost always a 'can't scan it?' link that reveals the secret as a string of letters and digits. That string, ignoring spaces, is exactly what this tool needs.

Why is my code rejected even though it looks right?

Usually clock drift or the wrong parameters. Check that your device clock is accurate, then confirm the period and digit count match the service. The previous and next codes shown here tell you instantly whether drift is the cause.

Should I use a website to generate my 2FA codes?

Not as your everyday authenticator. Two-factor authentication works because the second factor lives somewhere separate from your password. This tool is for testing an integration, checking a secret, or recovering access — use a phone app or hardware key for daily logins.

Which algorithm and digit count should I choose?

SHA-1 with 6 digits and a 30-second period, even though SHA-1 is dated elsewhere. Almost every authenticator app ignores the algorithm field of the otpauth URI and assumes SHA-1, so changing it usually breaks enrolment rather than improving security.

Related tools