Encoding & Decoding

TOTP Code Generator (2FA / Authenticator)

Generate TOTP codes from a Base32 secret in the browser, with SHA-1 / SHA-256 / SHA-512 and 6- or 8-digit codes that refresh with the system clock. Useful for troubleshooting and recovering two-factor login flows. Secrets stay local.

TOTP2FAAuthenticator

Favorite this tool

No favorite storage mode has been selected.

Quick actions

Copy this tool URL or open the system share sheet on a supported device.

Use cases

  • Reproduce codes when you already have the setup key
  • Compare Authenticator apps against server clock skew
  • Generate test TOTP values during development

How to use

  1. Enter the Base32 secret key
  2. Choose algorithm and digit length
  3. Copy the current code while it is still valid

Example input and output

Secret Key

JBSWY3DPEHPK3PXP

Notes

Produces a 6-digit TOTP for the current time window (refreshes on the countdown)

FAQ

Why is the code always wrong?

Confirm the secret is Base32, that algorithm and digits match the server, and that the device clock is accurate. Large clock skew breaks TOTP.

Is the secret uploaded?

No. The secret and codes are computed locally. Local processing omits the full secret and live code text.

Tools

Related tools

Continue with another translated tool for a nearby task.

Base32 Encode/Decode

Base32 Encoder and Decoder (RFC 4648)

Available

Encode and decode Base32 using uppercase A–Z and 2–7 per RFC 4648. Useful for case-insensitive secrets such as authenticator seeds. UTF-8 text is supported.

Encode Security

HMAC Generator

HMAC Generator - API Signature Digests

Available

Generate an HMAC locally from a message and key with SHA-1/256/384/512, outputting Hex and Base64. Useful for API signing and webhook verification checks.

HMAC Signature Hash

Password Strength Tester

Password Strength Tester — Entropy and Crack-Time Estimate

Available

Estimate password entropy, character-pool size, and theoretical offline crack time from length and character classes, with improvement suggestions. Evaluation runs entirely in the browser; passwords are not uploaded. Results are theoretical heuristics, not a guarantee of real-world security.

Password Security Entropy