Generate time-based one-time passwords (TOTP) for 2FA setup testing. Enter a Base32 secret to get rotating 30-second codes with countdown, fully offline.
Part of our Developer Tools collection — Explore more Developer Tools tools · See also: JSON Formatter, Base64 Encode / Decode.
Quick answer: OTP Generator (TOTP 2FA) — 30-sec 2FA codes Free, no signup, runs in your browser. See below for the interactive tool, 4-step guide and FAQs.
Base32 (A–Z, 2–7). 30s step, 6 digits, HMAC-SHA1.
Deep dives from the Tool4SaaS blog — tested workflows, print sizes and fixes.
Reviewed by the Tool4SaaS Editorial Team — In-house reviewers who build and test every tool locally for accuracy across current Chrome, Edge, Firefox, and Safari. Last updated: . See our authors, methodology or contact us.
Employ test secrets solely; never enter production 2FA seeds on shared machines. For illustration, demo JBSW seed displays six-digit codes safely, while genuine exchange keys must remain inside authenticator apps. Codes rotate every thirty seconds with fifteen-second countdown, letting developers rehearse enrolment and login flows without risking lockout.
Yes. Seeds and codes remain solely inside this tab through WebCrypto without transmission. For instance, Base32 demo JBSWY3DPEHPK3PXP . Pasted data is handled in-browser; it is neither stored nor transmitted. Never use genuine 2FA seeds here; reserve hardware-backed authenticators for live accounts.
Yes. Creation proceeds after load without servers; for example, demo seed shows six-digit code with countdown instantly. Wait thirty seconds to witness rotation like 123456 to 789012. Copy code or provisioning URI for tests. Strong secrets originate at /password-generator for enrolment trials.
TOTP divides Unix time into thirty-second counters, so drift beyond one step desynchronizes client and server counters. For example, a minute-fast device yields rejected codes despite correct seed. Synchronize via NTP, test rotation across two windows, and allow single-step tolerance server-side while logging repeated failures for support triage.
Generation produces time-based six-digit codes from Base32 secrets with thirty-second rotation for two-factor trials. Example 1: demo JBSW seed shows code and fifteen-second countdown for enrolment rehearsal. Example 2: waiting thirty seconds flips 123456 toward 789012 proving time linkage. HMAC-SHA1 counters underpin RFC 6238 logic via WebCrypto. Teams test authenticator flows without hardware tokens, rehearsing backup codes and recovery. Codes refresh automatically, countdown bars visualize urgency, and provisioning URIs encode issuer and account for QR experiments across staging environments.
Reference timing table: 0 to 30 seconds window one | 30 to 60 seconds window two | skew beyond 30 seconds fails | demo JBSWY3DPEHPK3PXP for trials | otpauth URI holds issuer | QR encodes URI. Paste demo seed, watch live code and bar, copy code or URI for tests. Edge case: NTP drift over thirty seconds yields false rejects, demanding clock sync. Never enter production seeds on shared PCs; employ test values. Validate across two consecutive windows before assuming failure in integration suites. Laboratories skewing clocks deliberately quantify tolerance thresholds through controlled drifts that inform server-side leeway settings across deployments while documenting NTP remedies quarterly now daily and runbooks.
Enter demo seed, note six-digit code, paste into test login before thirty-second expiry, watch successor appear. Second trial: generate provisioning URI, render QR, scan with test authenticator. Limitation: tester only, no recovery or server validation, and screen sharing leaks codes instantly. For robust secret creation, see the maker at /password-generator for random generation. For hash primitives behind TOTP, see the signer at /hash-generator for digest concepts. Second drill scanning provisioning QR validates issuer mapping, while archiving test vectors and timestamps supports regression suites across identity teams quarterly now daily for reliability and coverage and audits for assurance daily.