Introducing TOTP Generator: Test Your 2FA Secrets in the Browser
TOTP Generator is a browser-based tool that produces time-based one-time passwords from any TOTP secret key — the same codes generated by Google Authenticator, Authy, and similar apps. It runs entirely via the Web Crypto API, with no server involvement.
What Is TOTP?
TOTP stands for Time-based One-Time Password. It's defined in RFC 6238 and is the standard behind most authenticator apps. The algorithm works like this: a shared secret key (typically Base32-encoded) is combined with the current Unix timestamp, divided into 30-second windows, to produce a short numeric code via HMAC-SHA1. Both your device and the server independently compute the same code from the same secret and the same time, so no code is ever transmitted during login.
Who Is This Tool For?
TOTP Generator is primarily a development and testing tool. When you're building 2FA into an app, you need to verify that your server-side TOTP implementation is correct. Having a reference implementation that runs in the browser lets you instantly check what code should be generated for a given secret at the current moment — without installing an app or scanning a QR code.
It's also useful for IT and security teams who maintain TOTP secrets for internal systems and need a quick way to verify a secret without using their phone.
How It Works Technically
The implementation follows RFC 6238 precisely. The Base32 secret is decoded to raw bytes using a custom Base32 decoder (the standard RFC 4648 alphabet). The current Unix timestamp is divided by the period (30 seconds by default) and floor'd to get the counter value. The counter is packed into a big-endian 8-byte buffer. HMAC-SHA1 is computed over the counter using the key — this uses the browser's SubtleCrypto API (crypto.subtle.sign), which provides a native, hardware-accelerated implementation. Dynamic truncation extracts 4 bytes from the MAC output, and the result is taken modulo 10^6 to produce the 6-digit code.
Live Updates
The tool updates the code every second and shows a countdown bar indicating how many seconds remain before the code changes. Codes expiring within 5 seconds are highlighted in red — a cue familiar from authenticator apps. The "next code" field lets you see the upcoming code in advance, which is useful for avoiding a failed login due to entering a code right as it expires.
Configuration
You can set the period to 30 or 60 seconds and switch between 6 and 8 digit output — covering all standard TOTP configurations in common use.
Security Note
The secret key is processed entirely in-browser using the Web Crypto API. It is never sent to any server. That said, entering a live production TOTP secret into any web tool is inherently a trust decision. Use this tool for development testing, not for managing credentials in production systems.