OTP Generator

How to use it

1. Paste the Base32 secret from your service's two-factor setup — spaces and dashes are ignored and case does not matter.
2. Choose 6 or 8 digits; most services use 6, which is the default.
3. The code appears next to the countdown ring and refreshes automatically every 30 seconds.
4. Click Copy while the ring still shows time, then paste the code into the verification prompt.
5. Use Sample to load a well-known test key and watch the mechanics before using a real secret.

Common use cases

• Logging in without your phone — read the current code on your desktop while your authenticator device is out of reach.
• Verifying your own implementation — check that your server-side TOTP validation agrees with the standard algorithm on the same window.
• Server administration — answer SSH or VPN two-factor prompts without switching devices mid-session.
• Diagnosing clock drift — watch the 30-second window reset and confirm whether your machine's clock stays roughly in sync.

Why it stays private

The secret and the HMAC computation never leave your browser. The key is decoded locally, the signature is computed with the Web Crypto API, and nothing is written to storage or sent over the network. Close the tab and nothing remains.

FAQ

Q: Does it work with Google Authenticator or Authy secrets? A: Yes. Services that show a Base32 secret for authenticator apps use the same RFC 6238 scheme implemented here: HMAC-SHA1, a 30-second step and 6 digits by default.

Q: Why does my code not match the one in my app? A: The usual cause is clock drift, because TOTP depends on device time. If the difference is one or two whole windows, resync your computer's clock and compare again.

Q: Is it safe to paste a real secret here? A: The page has no backend and makes no network requests with your input; the secret exists only in the tab's memory. Even so, treat production secrets with care and close the tab when you are done.