ZenovayTools

TOTP Generator

Generate time-based one-time passwords (TOTP) for two-factor authentication. Enter a secret key and get the current 6-digit code with countdown timer.

100% client-side — your secret key never leaves your browser

--- ---

30s remaining

How to get your secret key

  • 1. Go to your account's 2FA/MFA settings
  • 2. Choose "Can't scan QR code?" or "Manual entry"
  • 3. Copy the Base32 secret key (e.g., JBSWY3DPEHPK3PXP)
  • 4. Paste it above to generate your authentication codes

How to Use TOTP Generator

  1. 1Enter or paste your TOTP secret key (Base32).
  2. 2See the current 6-digit code and countdown timer.
  3. 3Copy the code before it expires (30-second window).
  4. 4Optionally scan a QR code to extract the secret.
Zenovay

Privacy-first analytics for your website

Understand your visitors without invasive tracking. GDPR compliant, lightweight, and powerful.

Explore Zenovay

Related Tools

Password GeneratorGenerate strong, random passwords with customizable length, characters, and complexity.
Password Strength CheckerCheck how strong your password is. Get an estimated crack time and improvement suggestions.
HMAC GeneratorGenerate HMAC signatures using SHA-256, SHA-384, or SHA-512 with the Web Crypto API.
AES Encryption/DecryptionEncrypt and decrypt text using AES-GCM with PBKDF2 key derivation. Runs entirely in your browser.

Frequently Asked Questions

What is TOTP (Time-Based One-Time Password)?▾
TOTP is a two-factor authentication algorithm defined in RFC 6238. It generates a short numeric code (usually 6 digits) from a shared secret key and the current time. The code changes every 30 seconds. TOTP is used by Google Authenticator, Authy, Microsoft Authenticator, 1Password, and most 2FA systems. The server and client must share the same secret key and be synchronized within ~30 seconds.
How does TOTP work technically?▾
TOTP = HMAC-SHA1(secret, floor(timestamp / period)). The secret is a Base32-encoded key shared during setup. The timestamp is Unix time in seconds. The period is typically 30 seconds. The HMAC output is truncated to a 6-digit number using dynamic truncation (RFC 4226). Because both server and client compute the same HMAC with the same inputs, the codes match without any network communication.
Is this tool safe to use for my real 2FA codes?▾
This tool runs entirely in your browser — your secret key is never sent to any server. However, for daily 2FA use, dedicated authenticator apps (Google Authenticator, Authy, 1Password) are more practical because they securely store multiple secrets, work offline, and have backup/sync features. Use this tool for testing, development, or emergency code generation.
What is Base32 encoding?▾
Base32 encodes binary data using 32 ASCII characters (A-Z and 2-7). It is used for TOTP secrets because it is case-insensitive, human-readable, and avoids confusing characters (0/O, 1/l/I). A typical TOTP secret is 16-32 Base32 characters (80-160 bits). When you scan a QR code during 2FA setup, the URI contains the Base32-encoded secret.
Why is my TOTP code different from my authenticator app?▾
Most likely causes: 1) Time sync — your device clock is off by more than 30 seconds. 2) Wrong secret — copy the exact Base32 key without spaces. 3) Different algorithm — some services use SHA-256 or SHA-512 instead of SHA-1. 4) Different digit count — some use 8 digits instead of 6. 5) Different period — some use 60 seconds instead of 30. This tool uses the standard SHA-1/6-digit/30-second configuration.