Is it safe to paste my 2FA secret here?

It is safe in the specific sense that this page cannot transmit it — everything happens in your browser and the tool works offline. It is still a secret worth treating carefully: use it on a device you control, and do not paste it into any site that has not made the same guarantee and let you verify it.

The code is rejected even though the seed is right.

Your device clock is almost certainly wrong. TOTP is time-based and tolerates only about thirty seconds of drift either way. Switch on automatic time synchronisation and try again.

Which algorithm should I choose?

SHA-1, unless your provider explicitly specified otherwise. It is the RFC 6238 default and what nearly every service uses. SHA-1's weaknesses are in collision resistance, which does not apply to its use inside HMAC here.

What is the difference between TOTP and HOTP?

TOTP derives the code from the current time, so it changes every thirty seconds on its own. HOTP derives it from a counter that advances each time a code is used, so codes do not expire but the two sides can drift out of step. Time-based is far more common.

Can I use this instead of an authenticator app?

You could, but you should not. An authenticator keeps the seed in secure device storage; a browser page requires you to store the seed yourself and paste it each time, which multiplies the chances of it ending up somewhere it should not.

TOTP Code Generator

Turn a 2FA seed into the rotating six-digit code, offline.

Everything runs inside your browser. Your files never leave your device.

Input

Result

The result appears here as you type.

Ask about TOTP Code Generator

Questions about what this tool does, which option to pick, or what it can and cannot handle.

The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong. The tool itself is not guessing: it runs deterministic code on your device.

About the TOTP Code Generator

Two-factor codes are generated by arithmetic, not by magic and not by a network call. Your authenticator app holds a shared secret, combines it with the current time, and runs an HMAC. Every app doing this correctly produces the same six digits, because there is only one right answer.

This page does the same arithmetic. Paste the seed — the Base32 string a service shows beside the QR code during setup, or the whole “otpauth://” URI if you have it — and it shows the current code, the one before it, the one after it, and how many seconds are left before the current one expires. If you paste the URI, its own settings for digit count, period and algorithm override whatever the options say, because the service that issued it knows better than a default.

The obvious question is whether pasting a 2FA seed into a web page is sensible. Ordinarily it is not, and the reason is worth being precise about: with the seed, anyone can generate your codes forever. What makes it defensible here is that the page has no way to send it anywhere — the computation runs in your browser, and you can confirm that by disconnecting from the network and watching the codes keep rotating. That is the check to make of any site offering this, including this one.

The legitimate uses are narrow and real. Checking that a seed you have just backed up produces the same codes your phone does. Recovering access when the phone is lost but the seed was written down. Testing an authentication flow you are building without wiring up a real authenticator. What it is not is a replacement for an authenticator app, and it should not be your day-to-day way of logging in.

How to use it

1Paste the Base32 secret, or the full otpauth:// URI from a setup QR code, into the input.
2Leave the algorithm on SHA-1 and the period at 30 seconds unless the service told you otherwise — almost every provider uses those.
3Read the current code and the countdown beside it. The previous and next codes are shown because servers usually accept one step either side of the present.
4Switch to HOTP if your provider uses a counter rather than a clock, and set the counter to the value it expects.

Questions

Is it safe to paste my 2FA secret here?: It is safe in the specific sense that this page cannot transmit it — everything happens in your browser and the tool works offline. It is still a secret worth treating carefully: use it on a device you control, and do not paste it into any site that has not made the same guarantee and let you verify it.
The code is rejected even though the seed is right.: Your device clock is almost certainly wrong. TOTP is time-based and tolerates only about thirty seconds of drift either way. Switch on automatic time synchronisation and try again.
Which algorithm should I choose?: SHA-1, unless your provider explicitly specified otherwise. It is the RFC 6238 default and what nearly every service uses. SHA-1's weaknesses are in collision resistance, which does not apply to its use inside HMAC here.
What is the difference between TOTP and HOTP?: TOTP derives the code from the current time, so it changes every thirty seconds on its own. HOTP derives it from a counter that advances each time a code is used, so codes do not expire but the two sides can drift out of step. Time-based is far more common.
Can I use this instead of an authenticator app?: You could, but you should not. An authenticator keeps the seed in secure device storage; a browser page requires you to store the seed yourself and paste it each time, which multiplies the chances of it ending up somewhere it should not.