Generate a 2FA code from a secret
For the day the phone is lost. The same HMAC-SHA1 maths an authenticator app runs, against the secret you already have.
How TOTP Generator works
Hashes and keys are produced with the Web Crypto API inside this page. A hash computed on a server would mean sending the thing you are trying to protect. Verification here is a comparison you can repeat yourself, not a claim you have to accept.
That is the whole architecture: static files, one script, no upload endpoint to leak or log. Close the tab and the work is gone.
Good to know
- Works offline once loaded, including on flights and in locked-down networks.
- No file size limit beyond your device's own memory.
- Free to use, with no account and no usage counter.
- Results are produced locally, so they are not logged or shared with anyone.
Questions
Is it safe to paste a 2FA secret?
The secret stays in this tab: it is used in memory, never written to storage, never logged and never sent. Still, treat it like a password — anyone who sees it can generate your codes forever. Use it for recovery, not as your daily authenticator.
Why does the code not match my app?
Almost always a clock difference. TOTP uses the device clock; if it drifts more than one 30-second period the codes diverge. Check that automatic time is on.
What is the period setting for?
Some services use 60 seconds instead of the default 30. If both settings look wrong, the period is the usual culprit.
Can it generate 8-digit codes?
Yes. Six is the norm; a few banking systems use eight.
Keep going
More security tools
AES Encrypt / Decrypt
Encrypt text with AES-256-GCM and a key derived by PBKDF2, or decrypt a blob with the same passphrase. Salt and IV are packed in, so every run differs.
Open toolHash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files directly in your browser.
Open toolUUID Generator
Generate cryptographically random UUID v4 values in bulk, then copy or download them as a list.
Open toolPassword Generator
Create strong random passwords with a custom length, symbols and passphrase options, generated only in your browser.
Open toolJWT Decoder
Inspect the header and payload of any JWT and see its expiry status. Decoding only — the signature is not verified.
Open toolPassword Strength Checker
Estimate password entropy and offline crack time, with feedback on length and character pool.
Open tool