--- title: "TOTP Code Generator - Private Online Authenticator | CanDoYa" description: "Generate a current TOTP or 2FA code from a Base32 secret in your browser. RFC 6238 checked, memory-only, with no upload, storage, or sign-up." url: https://candoya.com/tools/totp-code-generator/ locale: en type: browser-tool --- # Free TOTP Code Generator Category: Developer ## What is a TOTP code generator? A TOTP code generator turns a shared Base32 secret and the current time into the rotating verification code used by authenticator apps. This page follows RFC 6238 with SHA-1, SHA-256, or SHA-512 and computes the result locally. Your secret stays in memory only and is cleared when you reset or leave. This generator accepts a Base32 secret or a standard `otpauth://totp` setup URI, then uses your browser's native Web Crypto engine to calculate the current code. It makes no request with your input, writes nothing to browser storage, and never puts the secret in the page URL. For real accounts, use a trusted authenticator or password manager as your everyday vault and treat this page as a temporary recovery, testing, or interoperability aid. **QR handling is deliberately out of scope:** the tool does not upload screenshots, open a camera, create a QR code, or export a setup URI. That keeps the secret's exposure surface small; use your authenticator's trusted provisioning flow when a QR code is required. ## How to use it 1. **Enter the secret** - Type a Base32 setup key or paste an otpauth://totp URI. The secret stays masked by default. 2. **Match the account settings** - Choose SHA-1, SHA-256, or SHA-512, then select 6 or 8 digits and the correct time period. URI parameters are applied automatically. 3. **Use the current code** - Copy the code before the countdown reaches zero. A new code appears automatically for the next time step. 4. **Clear the session** - Select Clear as soon as you finish so the active secret field and generated result are reset. ## Who it's for - **Developers and QA teams** checking a TOTP integration against a known Base32 test secret. - **Support engineers** confirming that algorithm, digit count, period, and system time agree across two implementations. - **Account owners** using a trusted device for a temporary code when their regular authenticator is unavailable. - **Security learners** exploring how the RFC 6238 time step changes a code without sending the secret to a server. ## Expert note RFC 6238 defines TOTP as HOTP over floor((Unix time - T0) / period), using an unsigned 8-byte counter. The implementation is checked against all 18 official Appendix B vectors, including the year 2603 case that catches code limited to 32-bit time. ## Frequently asked questions ### Is my TOTP secret uploaded or stored? No. The secret is processed by the Web Crypto API in your browser and is never submitted to a server, written to localStorage, placed in the URL, or logged by the tool. It remains in page memory until you select Clear, close the tab, or navigate away. ### Is this TOTP code generator free? Yes. It is free to use with no account, download, or usage limit. The page can keep generating codes after it has loaded because the algorithm and clock run locally in your browser. ### What TOTP settings are supported? The generator supports HMAC-SHA-1, HMAC-SHA-256, and HMAC-SHA-512, with 6 or 8 digits and 30 or 60 second periods in the interface. It accepts unpadded or correctly padded RFC 4648 Base32 secrets and standard otpauth://totp setup URIs. ### Why does my 2FA code not match my authenticator app? Check that both devices have accurate system time and use the same algorithm, digit count, and period. Most accounts use SHA-1, 6 digits, and 30 seconds. A mismatch in any setting, or a secret copied with the wrong character, produces a different code. ### Can I paste an otpauth URI? Yes. Paste a standard otpauth://totp URI and the tool reads its secret, algorithm, digits, and period in memory. HOTP URIs are rejected because HOTP uses an event counter rather than time. The URI is never saved or exported. ### Does this tool scan or generate 2FA QR codes? No. QR upload, camera scanning, QR creation, and secret export are deliberately excluded. Direct text paste is easier to inspect and avoids keeping a sensitive QR image or downloadable setup artifact. Use your authenticator's trusted provisioning flow when a QR code is required. ### Is an online TOTP generator safe for a real account? A browser-local generator avoids sending the secret to a server, but the secret is still a long-lived credential. Use only a device and browser you trust, avoid extensions you do not trust, clear the field afterward, and prefer a dedicated authenticator or encrypted password manager for routine use. ## Related tools - [Password Generator](https://candoya.com/tools/password-generator/) - [QR Code Generator](https://candoya.com/tools/qr-code-generator/) - [JWT Generator](https://candoya.com/tools/jwt-generator/) - [SHA-256 Hash Generator](https://candoya.com/tools/sha-256-hash/) - [Base64 Encode and Decode](https://candoya.com/tools/base64-encode-decode/) --- *Markdown edition of , published for AI agents and other automated readers. Index of key pages: .*