Paste or drop a Base32 secret or otpauth URI. To generate several codes, paste one entry per line.
Check the secret or QR image carefully, and clear the form when you finish.
Get 2FA Code
Generate a time-based one-time password from a Base32 secret, otpauth URI, or QR code image. No account is required.
How to generate a TOTP code
Enter the setup secret or otpauth URI supplied by the service, then use the current code before its timer expires.
Use it safely
Treat the setup secret like a password. Generate only the code you need, then clear the secret when you finish.
2FA code questions
Why does my code differ from another authenticator?
Both generators must use the exact same Base32 secret, algorithm, digit count, time period, and current time. One changed character in the secret produces unrelated codes. A device clock that is early or late can place the generators in different time windows, especially near the countdown boundary. Compare the otpauth parameters, correct automatic time synchronization, and wait for a fresh period before testing again. Issuer and account labels organize entries but do not normally change the mathematical code.
How long is each TOTP code valid?
The validity window follows the token period stored in the configuration, commonly 30 seconds but not universally. The countdown shows when the current value changes. A receiving service may tolerate a neighboring time window to account for small clock differences, but that behavior is controlled by the verifier and should not be assumed. Enter the code with enough time remaining, and if it is rejected near zero, wait for the next code rather than repeatedly submitting an expiring one.
Can I use a Base32 secret, otpauth URI, or QR image?
Yes. Enter a compatible Base32 secret, paste an otpauth URI, or choose a PNG, JPG, or WebP image containing a supported TOTP QR code. An otpauth URI can carry the secret plus algorithm, digit count, period, issuer, and account label. Review the parsed details before using the code. Counter-based HOTP is not supported. If QR decoding fails, use the original setup secret or URI supplied by the service rather than transcribing a low-quality screenshot.
What is the difference between TOTP and HOTP?
TOTP derives changing one-time codes from a shared secret and the current time window. HOTP derives codes from a shared counter that advances after use. They are related standards but are not interchangeable. A TOTP generator cannot correctly reproduce an HOTP token by guessing a time period, and a service expecting TOTP will reject a counter-based value. Confirm the otpauth type and setup instructions. This tool accepts TOTP configurations and rejects HOTP URIs rather than producing misleading codes.
How should I protect a TOTP setup secret?
Treat the setup secret or QR image like a password capable of generating future codes. Do not publish it, place it in screenshots, send it through an untrusted channel, or confuse it with the short code that expires. Use the secret only for an account you are authorized to access, clear it when finished, and follow the service's recovery and backup guidance. If a secret may have been exposed, replace the two-factor setup at the service rather than relying on codes continuing to change.