TOTP generator.
Paste a TOTP secret or an otpauth link to get the current 2FA code with a countdown, check a code, or make a new secret with its QR code. Computed in your browser.
TOTP generator.
Need the UI around it? With Pro, your AI agent builds the form, the result card and the rest of the page from a prompt.
Get ProHow it works
4 steps, no account. It runs in your browser and nothing is uploaded.
Paste the secret
A Base32 secret or a whole otpauth:// link from a QR code.
Check the settings
The algorithm, digits and period are read from a link, or set in the bar.
Read the code
The current code with a countdown, the next one, and a verifier.
Or make a new secret
New secret draws one, with the QR code an authenticator app scans.
Related tools
More security and dev tools. Every one free, in the browser.
Pricing
Build it with Pro
The tool is free. Pro adds 6,000+ blocks, premium templates and the MCP server, so your AI editor builds the product around it.
4.9/5 out of 5 · 150+ reviewsfrom 150+ founders and developers.
- Secure checkout via Stripe
- Code lives in your repo
- Keep what you've shipped if you cancel
- License terms
Questions and answers
Before you trust the result: what to know about the format, the limits, your data and the tools next to it.
A one-time password computed from a shared secret and the clock (RFC 6238): the time is cut into 30-second steps, the step number is HMAC'd with the secret, and six digits are taken from the result. Your authenticator app and the server do the same sum, so their codes agree.
The shared secret, usually 20 random bytes written in Base32 (letters A–Z and digits 2–7), often shown as a QR code holding an otpauth:// link. Anyone with it can make your codes, so it deserves the same care as a password.
HOTP (RFC 4226) counts events instead of time: each code uses the next counter value. TOTP is HOTP with the counter taken from the clock, which is why almost every app and site uses it.
Codes depend on the clock, so a device more than a step off produces the wrong one. Servers usually accept the previous and the next step as well; the verifier here does the same and says which step matched.
Paste the Base32 secret or the whole otpauth:// link; the issuer, account, algorithm, digits and period are read from the link. The current code, the next one and a countdown appear at once.
Press New secret, fill in the issuer and account, and scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy, Aegis). The otpauth link is there to copy for your server's setup.
No. The codes are computed with the Web Crypto API in your browser, the QR code is drawn in the page, and nothing is sent. Close the tab and the secret is gone.
No. The TOTP generator is free and opens without a sign-in, an account or an install.
Nothing. The TOTP generator holds your input in the page's memory, so closing or reloading the tab clears it, and it saves nothing in this browser.
Closest to the TOTP generator: Password generator, QR code generator, Base32 encoder, Random string generator. Each opens on its own page, free and in the browser.
The TOTP generator is one of 20 in its group. The group's page, /tools/security, lists them all.
The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.
4.9 out of 5 from 150+ developers
Build the product around it
Every block, template and icon, installed by your AI agent in your theme. The tools stay free.
Get Pro