TOTP generator online: generate time-based one-time passwords for testing

Generate a time-based one-time password from any TOTP secret key with the TOTP generator at ToolHQ. Enter the Base32 secret key and get the current 6-digit code with a live countdown to the next refresh. Computed entirely in your browser, your secret key is never sent to any server.

TOTP (Time-based One-Time Password) is the standard behind authenticator apps like Google Authenticator and Authy. The code shown by an authenticator app is derived from two things: a shared secret key and the current time. A server verifies your 2FA code by running the same calculation using the same secret key it stored when you set up 2FA. If the codes match, you are authenticated. ToolHQ's TOTP generator lets developers generate codes from any secret key for testing, verification, and debugging purposes.

Key Takeaways

• TOTP is defined in RFC 6238 and is the standard behind Google Authenticator, Authy, and most 2FA apps
• Codes are derived from a shared secret key and the current Unix timestamp, not transmitted from a central server
• Codes are valid for 30 seconds (one time step), then a new code is generated
• Primarily a developer tool: for testing 2FA flows, verifying secret key setup, and debugging authenticator issues
• Your secret key is computed in your browser and never sent to any server

---

How TOTP works

TOTP (RFC 6238) is built on top of HOTP (HMAC-based One-Time Password, RFC 4226). The key insight is replacing the counter in HOTP with a time value.

The TOTP algorithm:

1. Calculate the time step counter: Divide the current Unix timestamp by the time step (30 seconds by default). The result, rounded down to an integer, is the counter value. For example, at Unix timestamp 1700000000, the counter is 1700000000 / 30 = 56666666.
2. Compute HMAC-SHA1: Apply HMAC with SHA-1 using the shared secret key and the counter value as inputs.
3. Dynamic truncation: Extract a 4-byte segment from the HMAC output using a dynamic offset calculation.
4. Compute the OTP: Take the 4-byte value modulo 10^6 to get a 6-digit number. Pad with leading zeros if necessary.

This process runs independently on the authenticator app and on the server, using the same secret key and the same current time. As long as their clocks are synchronised (within the time step tolerance), they produce the same code without any communication between them.

The code changes every 30 seconds because the time step counter increments every 30 seconds. Most implementations accept codes from the previous and next time step to accommodate clock drift of up to 30 seconds.

---

TOTP vs. HOTP: what is the difference

HOTP (HMAC-based One-Time Password) uses a counter that increments each time a code is generated. The counter must be synchronised between client and server, which creates synchronisation problems when codes are generated but not used.

TOTP uses time instead of a counter. Both client and server know the current time, so no synchronisation is needed beyond having reasonably accurate clocks. TOTP has become the dominant standard because it is simpler to implement and maintain.

Property	HOTP	TOTP
Standard	RFC 4226	RFC 6238
Counter	Incrementing integer	Unix timestamp / 30
Code validity	Until the next code is generated	30 seconds
Synchronisation needed	Yes	No (only requires time sync)
Common use	Legacy hardware tokens	All modern authenticator apps

---

The role of the Base32 secret key

When you set up 2FA on an account, the service generates a random secret key and shares it with you, usually as a QR code and a backup text code. The text code is the same secret encoded in Base32.

Base32 uses a 32-character alphabet (A-Z and 2-7) and is the standard encoding for TOTP secrets because it avoids ambiguous characters (no 0/O, 1/I/l confusion) and is case-insensitive. A typical TOTP secret looks like: JBSWY3DPEHPK3PXP

When you scan a QR code with Google Authenticator or Authy, the app extracts this Base32 secret key and stores it locally. It never needs to contact the server again to generate codes; all subsequent code generation happens locally using the shared secret and the device's clock.

ToolHQ's TOTP generator accepts the same Base32 secret key format. Paste the backup code from a service's 2FA setup screen and the tool generates the current code.

---

Developer and testing use cases

Testing 2FA implementation: When building 2FA into an application, use the TOTP generator to verify that your server-side TOTP verification accepts codes from the correct secret key. If the tool generates a code and your server rejects it, there is a bug in your implementation.

Verifying secret key setup: After a user sets up 2FA, confirm that the secret key stored in your database correctly corresponds to the code the user's authenticator app shows by generating the code from the stored key and comparing.

Debugging authenticator issues: If a user reports that their authenticator app codes are not working, use the TOTP generator with their stored secret key to confirm the server-side expected code, then compare to what the user reports seeing.

Automated testing: In end-to-end tests that require logging in through a 2FA flow, the TOTP algorithm can be implemented in the test framework using the test account's secret key to generate valid codes programmatically.

Mini-story: A developer was building a 2FA login flow and kept getting "invalid code" errors even though she was using the correct secret key. She pasted the secret key into ToolHQ's TOTP generator and saw the code it produced. Then she added logging to her server-side TOTP verification function and compared. The server was computing the correct code but was using UTC+0 while her testing environment was sending codes computed from a local time zone offset. The TOTP generator helped her isolate exactly where the mismatch was occurring.

---

How to use the TOTP generator step by step

1. Open the tool. Visit ToolHQ's TOTP generator.
2. Enter the secret key. Paste the Base32 secret key. This is the backup code shown during 2FA setup, typically 16-32 uppercase letters and digits.
3. Generate the code. The tool computes the current TOTP code and displays it with a countdown showing how many seconds remain until it refreshes.
4. Use the code. Copy the 6-digit code for your testing or debugging purpose.
5. Note the countdown. If you need to enter the code somewhere, note the remaining seconds. If fewer than 5 seconds remain, wait for the next code to avoid a timeout at the validation step.

---

Frequently asked questions

Should I use this to store my real 2FA secret keys? No. This is a developer and testing tool. Your real 2FA secret keys should be stored in a dedicated authenticator app on your mobile device. Entering real 2FA secrets into a web tool introduces unnecessary risk compared to keeping them in a dedicated authenticator app.

Why does the code change every 30 seconds? The 30-second time step is a design choice in RFC 6238 that balances usability (users have time to type the code) with security (old codes expire quickly, limiting replay attack windows). Some implementations use 60-second steps.

What does "time step" mean? The time step is the interval in seconds for which each TOTP code is valid. The default is 30 seconds. A time step of 30 means the counter increments every 30 seconds, producing a new code. Some systems use 60-second steps.

Can I use TOTP codes more than once? No. A correct implementation rejects a code that has already been used, even within the same 30-second window. This prevents replay attacks where an attacker intercepts a valid code and uses it again.

What if my clock is slightly wrong? Most TOTP implementations accept codes from the current, previous, and next time step, giving a 90-second total validity window to accommodate clock drift. If your clock is more than 30 seconds off, codes will fail. Keep your system clock synchronised.

---

The short version

TOTP generates a 6-digit authentication code by applying HMAC-SHA1 to a shared secret key and the current Unix time, producing a code that refreshes every 30 seconds. The magic is that both the authenticator app and the server compute this independently using only the shared secret and the time, no communication required. ToolHQ's TOTP generator implements this algorithm in your browser, accepting any Base32 secret key and displaying the current code with a live countdown. Use it to test 2FA implementations, verify secret key setups, and debug authentication flows.

Generate a TOTP code at ToolHQ.

Related tools: Random token generator | Encryption tool | Password generator | Hash generator