100% free · Runs 100% in your browser · No signup needed
Security notice: This is a client-side backup viewer and learning demo for TOTP codes. Your secret is processed only in your browser and never sent anywhere — but for real accounts, a dedicated authenticator app on your phone is the safer choice. Please read the Important Security Notice section below before pasting any real secret.
TOTP — Time-based One-Time Password (RFC 6238) — is the technology behind the six-digit codes login screens ask for after your password.
The idea is simple: you and the service share a secret key, and both sides independently compute a short code from that secret plus the current time. The code changes every 30 seconds, and only someone holding the secret can produce the right one.
This generator implements that algorithm entirely in your browser using the WebCrypto API's HMAC-SHA1. You paste your Base32-encoded secret (spaces and dashes are tolerated, and the character set is validated so typos get flagged instead of silently producing wrong codes), optionally add account and issuer labels to keep multiple secrets organized, and choose 6 or 8 digits with a 30- or 60-second period to match what your service expects.
The current code is shown big and readable with a one-click copy button, beside a seconds-remaining ring showing exactly when it rotates. A previous/next code preview helps when a service accepts a small time window around the current step. And because many people set up 2FA by scanning a QR code, the tool renders an otpauth:// QR code from your secret and labels — scan it with your authenticator app to enroll the account there in seconds.
A TOTP secret is the master key to your second factor: anyone who holds it can generate your login codes without your password or your phone. Treat it with the same seriousness as a password — actually, more.
This page is a backup viewer and learning tool. It is genuinely private — the code runs entirely in your browser and your secret is never transmitted, stored, or logged — but a browser tab is not a vault. For accounts that matter (email, banking, hosting, domain registrar), use a dedicated authenticator app on your phone for daily code generation, keep this tool for emergencies, testing, and learning how TOTP works. Never paste a real secret on a shared or public computer, never screenshot secrets, and always save the backup/recovery codes your service gives you at setup time — they are your lifeline if you lose access.
Running websites that hold customer data? Your hosting choice is part of your security posture too. FistHost web hosting starting at just $0.99 per month gives you reliable, secure hosting with a free domain included — a solid, trustworthy home for your projects while you keep your accounts locked down with proper two-factor authentication.
Developers and QA testers use it to verify 2FA login flows without reaching for a phone on every test run. System administrators keep it as an emergency viewer when their primary device is unavailable. Security students use it to see RFC 6238 in action and understand what their authenticator app is really doing. And anyone enabling two-factor authentication can use the QR export to move an account onto their phone in seconds.
Technically yes: everything runs locally in your browser via WebCrypto, and your secret is never sent, stored, or logged — refreshing wipes it completely. But as the security notice above explains, a browser tab is a backup viewer, not a vault. Prefer your phone's authenticator app for real, valuable accounts, and never paste secrets on shared computers.
The four usual suspects: (1) your device clock is off — enable automatic time sync; (2) the secret was mistyped or truncated — the validator flags bad characters, but a wrong-but-valid secret still fails; (3) digits/period mismatch — confirm whether the service wants 6 or 8 digits, 30 or 60 seconds; (4) you entered the code at the very end of its window and it expired mid-submit.
It is your shared key encoded with the characters A–Z and 2–7 (Base32), which makes it safe to display and type. During 2FA setup, services show it as the "manual entry key" alternative to the QR code. Spaces and dashes in it are just formatting — this tool strips them automatically.
Yes. Once the page loads, no network is needed at all — the algorithm only needs your secret and the current time, both available locally.
Yes — that is what the QR export is for. Render the otpauth:// QR code and scan it with your authenticator app; the account enrolls with your labels intact. Afterwards, clear the secret from this page.
No. There is no account, no database, and no analytics on what you enter. Secrets exist only in the page's memory while it is open and are gone the moment you refresh or close the tab.
Good security is a habit, and good hosting is its foundation. FistHost web hosting starting at just $0.99 per month includes a free domain, dependable servers, and support that treats your projects like they matter — because with strong passwords, two-factor authentication, and hosting you can trust, your online presence is protected on every front.
No reviews yet. Be the first to review this tool!
Reviews are protected by captcha and moderated before they appear.