TOTP code generator

Paste a 2FA secret key and see the code it is producing right now, and how long that code has left. Nothing is uploaded, nothing is stored — the whole thing happens in this tab.

Secret key

The base32 key your service showed you — spaces and dashes are fine. You can also paste a whole otpauth://totp/… link and the settings below fill themselves in.

••• •••

Enter a secret key to see its current code.

The code is computed here, in this tab. Your secret is never sent to us, never written to the address bar, and never saved — closing the page is all it takes to be rid of it. Once a key is in the field, the page asks this site for the current time — a timestamp and nothing else — so that a clock running wrong here cannot quietly produce a wrong code. Your secret is not part of that request and never leaves this tab.

Your secret stays here

The code is computed in your browser with its own crypto. The only thing this page asks the site for is the current time, to catch a clock that has drifted — your secret is not in that request and never leaves the tab.

Rejected code? Check the clock

TOTP is the time plus the secret, so a device running a minute fast produces codes that are correct and still refused. How to check your clock.

Unusual settings

A handful of services use SHA256, eight digits or a 60-second window. What those settings mean.

What this is for

• Checking a key. Confirm a secret you just copied really produces the code the service is expecting, before you rely on it.
• Diagnosing a rejected code. If this page and your authenticator disagree, the secret is wrong; if they agree and the service still refuses, it is the clock or the settings.
• Getting in once. A one-off login from a machine you trust, when the device that normally holds your codes is not to hand.

Looking for the key itself? It is the string a service shows behind “can’t scan the QR code?” during 2FA setup — where to find it.

Not a place to keep your secrets

A TOTP secret is a long-term key: anyone holding it can generate your codes forever. Typing one into a web page — this one included — is a deliberate act, worth doing on a machine you trust and for the reasons above. It is not where the key should live day to day, and this page keeps nothing, so there is nothing here to come back to.

For everyday 2FA, keep your secrets in the extension: they stay on your device, can be locked behind a password, and are backed up locally so a browser reset does not cost you your accounts.

Keep your codes one click away

Authenticator generates the same codes from your browser toolbar, offline, without pasting a secret anywhere.

Add to Chrome — It's Free