OTP Generator — TOTP One-Time Password Generator for 2FA Testing | DevKits
Generate time-based one-time passwords (TOTP RFC 6238) from a Base32 secret. Real-time counter with 30-second expiry. Perfect for 2FA testing and authenticator app debugging. 100% local.
Last updated:
CommentsGenerate TOTP 6-digit time-based one-time passwords from any Base32 secret.
One-Time Code
------
Expires in 30s
Use this OTP for 2FA testing. Paste your authenticator app's Base32 secret to generate matching codes.
What is OTP Generator?
TOTP (RFC 6238) is the algorithm behind Google Authenticator, Authy, and every '6-digit code that changes every 30 seconds' 2FA app. It computes HMAC-SHA1 over the secret key and the current 30-second counter, then truncates to 6 digits. This generator reproduces that algorithm using Web Crypto API.
How to generate OTPs
- 1Paste your Base32 secret.
- 2A 6-digit code appears and refreshes every 30 seconds.
- 3Use it for 2FA login testing or debugging authenticator app mismatch.
Frequently Asked Questions
What's the difference between TOTP and HOTP?
TOTP (RFC 6238) generates codes based on the current time, typically expiring every 30 seconds. HOTP (RFC 4226) generates codes based on a counter that increments each use. Most authenticator apps (Google, Authy) use TOTP.
Where do I get the Base32 secret?
When you enable 2FA on a service, you're usually shown a QR code. The URL encoded in that QR code (otpauth://totp/...) contains the Base32 secret. You can extract it by scanning the QR code with a reader.
Try Next
AES Encrypt / Decrypt
Encrypt and decrypt text with AES (128 / 192 / 256, GCM authenticated or CBC legacy) using a password. PBKDF2 key derivation with 200,000 iterations. 100% local — the Web Crypto API runs entirely in your browser.
Related Tools
JWT Decoder
Decode JSON Web Tokens (JWT) to inspect the header, payload, and signature. Runs entirely in your browser — tokens are never sent to any server.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text online. Free, no signup — all hashing runs entirely in your browser via the Web Crypto API, so nothing is uploaded.
HMAC Generator
Compute HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 online. Verify API requests, sign webhooks, and authenticate messages. Free, no signup — signing runs locally via the Web Crypto API, secrets never leave your browser.
MD5 Generator
Compute MD5 hashes of text or files instantly online. Drag-and-drop file support for checksums of any size (streaming, GB-scale friendly). Verify against a known MD5 with one click. 100% local — nothing is uploaded.
SHA-1 Generator
Generate SHA-1 (160-bit) hashes of any text or file online. Drag-and-drop file support for GB-scale checksums via Web Crypto API. Verify against a known SHA-1 in one click. 100% local.
SHA-256 Generator
Compute SHA-256 (256-bit) hashes of text or files instantly online. The gold-standard cryptographic hash for signatures, blockchain, and integrity. Drag-and-drop file support; verify against a known SHA-256 in one click. 100% local.