Skip to content
🛠️ToolsShed

TOTP Code Generator

Generate time-based one-time passwords (TOTP) compatible with Google Authenticator.

Current Code

------

Expires in 30s

Next Code

------

Compatible with Google Authenticator, Authy, and other TOTP apps. Add this secret to your authenticator app to verify codes.

About this tool

A TOTP (Time-based One-Time Password) Code Generator creates six-digit authentication codes that change every 30 seconds, synchronized with your device's time. These codes are the backbone of two-factor authentication (2FA) used by Gmail, GitHub, AWS, and thousands of other services. This tool generates the same codes that apps like Google Authenticator produce, making it invaluable for developers testing authentication flows, security researchers auditing 2FA implementations, and anyone who needs to verify that a shared secret is working correctly.

To use this tool, paste your shared secret (the base32-encoded key you get when setting up 2FA) into the input field. The tool immediately displays the current six-digit code, along with a countdown timer showing how many seconds remain before the code expires and a new one is generated. You can copy the code instantly, and it refreshes automatically every 30 seconds as time progresses. This is particularly useful during development, debugging, or testing authentication systems where you need quick access to predictable TOTP values.

Remember that this is a helper tool for development and testing, not a replacement for a real authenticator app to protect your personal accounts. All computation happens locally in your browser—your shared secret is never stored, transmitted, or logged anywhere. For production account security, always use a dedicated authenticator application like Google Authenticator, Authy, or Microsoft Authenticator on your phone.

Frequently Asked Questions

Code Implementation

import hmac, hashlib, struct, time, base64

def hotp(secret_b32: str, counter: int, digits: int = 6) -> str:
    """HMAC-based One-Time Password (RFC 4226)."""
    key = base64.b32decode(secret_b32.upper().replace(" ", ""))
    msg = struct.pack(">Q", counter)                       # 8-byte big-endian counter
    h   = hmac.new(key, msg, hashlib.sha1).digest()
    offset = h[-1] & 0x0F
    code   = struct.unpack(">I", h[offset:offset+4])[0] & 0x7FFFFFFF
    return str(code % (10 ** digits)).zfill(digits)

def totp(secret_b32: str, digits: int = 6, period: int = 30) -> str:
    """Time-based One-Time Password (RFC 6238)."""
    counter = int(time.time()) // period
    return hotp(secret_b32, counter, digits)

def totp_remaining_seconds(period: int = 30) -> int:
    """Seconds until the current TOTP window expires."""
    return period - (int(time.time()) % period)


# Demo — replace with your own base32 secret
SECRET = "JBSWY3DPEHPK3PXP"
print(f"TOTP: {totp(SECRET)}  (expires in {totp_remaining_seconds()}s)")

Comments & Feedback

Comments are powered by Giscus. Sign in with GitHub to leave a comment.