Question 1

What is TOTP?

Accepted Answer

TOTP (Time-based One-Time Password) is an algorithm defined in RFC 6238. It generates a short-lived numeric code (typically 6 digits) from a shared secret key and the current Unix time, divided into 30-second intervals. Apps like Google Authenticator and Authy implement TOTP.

Question 2

Is this tool safe to use with my real 2FA secrets?

Accepted Answer

This tool runs 100% in your browser using the Web Crypto API. No data is sent to any server. That said, as a best practice, avoid using real production 2FA secrets in online tools. Use it for testing and development purposes.

Question 3

What is a base32 secret?

Accepted Answer

A base32 secret is the shared key between the authenticator app and the service. It uses only the characters A–Z and 2–7. When you set up 2FA on a service, it typically shows you a QR code and a base32 text secret — this tool accepts that text secret.

Question 4

Why does the code change every 30 seconds?

Accepted Answer

TOTP uses the current Unix timestamp divided by 30 as a counter. Every 30-second window produces a different code. This short validity window is what makes TOTP codes secure — even if intercepted, they expire almost immediately.

Question 5

What algorithm does this tool use?

Accepted Answer

This tool implements RFC 6238 using HMAC-SHA1 via the Web Crypto API SubtleCrypto.sign(). It uses a 30-second time step, 6-digit output, and standard base32 key decoding — identical to Google Authenticator and other TOTP apps.

TOTP Generator

TOTP Generator