TOTP Generator

TOTP is an algorithm that generates a unique, temporary 6-8 digit code based on a shared secret key and the current time. It's widely used for two-factor authentication (2FA) to add an extra layer of security beyond just a password. The code changes every 30 seconds (or other configured period), making it extremely difficult for attackers to intercept and reuse.

Yes, 100%. All calculations happen entirely within your browser using JavaScript and the Web Crypto API. No data is ever sent to any server. Your secret keys are stored only in your browser's localStorage and never leave your device. You can even disconnect your internet after loading the page, and it will continue working perfectly.

When you enable 2FA on a service (Google, GitHub, Dropbox, etc.), they typically show a QR code. Look for an option like "Can't scan the QR code?" or "Enter key manually." This will reveal a Base32-encoded string (e.g., JBSWY3DPEHPK3PXP). Copy that string and paste it into this tool. Never share your secret key with anyone.

TOTP (Time-based) generates codes based on the current time, so the code changes every 30 seconds. HOTP (HMAC-based) generates codes based on a counter that increments each time you use it. TOTP is more commonly used for consumer 2FA because it doesn't require synchronization of a counter between the server and your device.

TOTP codes are synchronized to absolute Unix time, divided into intervals (usually 30 seconds). The countdown shows how many seconds remain in the current interval. If you add an account at 15 seconds past the minute, the first code is only valid for the remaining 15 seconds of that interval. This is normal and ensures synchronization with the server.

localStorage is accessible only to JavaScript running on the same domain. As long as your browser is free of malicious extensions and the page is served over HTTPS (or loaded locally), the risk is minimal. For enhanced security, consider using a dedicated authenticator app with biometric protection. This tool is designed for convenience and transparency — you can inspect the source code to verify that no data is exfiltrated.

Yes! Click the Export button to download all your accounts as a JSON file. You can later use the Import button to restore them. Keep this file in a secure location — it contains your secret keys in plain text. You can also paste otpauth:// URIs directly into the import area.

TOTP is generally more secure than SMS-based 2FA. SMS messages can be intercepted through SIM-swapping attacks, SS7 vulnerabilities, or social engineering. TOTP codes are generated locally and never travel through telecom networks. Additionally, TOTP works even when you don't have cellular reception — perfect for travel or areas with poor signal.

This tool supports SHA-1 (most common, used by Google Authenticator), SHA-256, and SHA-512. SHA-1 is the default and is compatible with virtually all TOTP services. Some enterprise applications may require SHA-256 or SHA-512 for enhanced security. You can also configure the code length (6, 7, or 8 digits) and the time period (15, 30, or 60 seconds).