Yes. This tool runs entirely in your browser using the Web Crypto API. Your secret key is never transmitted to any server. After the page loads, zero network requests are made — you can verify this in your browser's Developer Tools → Network tab.
The code is open source, so you can audit exactly what runs. For maximum security, you can even disconnect from the internet after the page loads and it will continue to work.
A Base32 secret key is a string of letters (A–Z) and numbers (2–7) that a service provides when you enable two-factor authentication. It is the shared secret between you and the service that makes TOTP codes work.
It typically looks like JBSWY3DPEHPK3PXP and is 16–32 characters long. When you first set up 2FA on a service, you are usually shown both a QR code and this text key. If you only scanned the QR code originally, you may need to re-enroll to obtain the text key.
Yes. This tool generates the same TOTP codes as Google Authenticator, Microsoft Authenticator, Authy, 1Password, and any other RFC 6238-compliant authenticator app.
As long as you have the correct Base32 secret key and matching settings (algorithm, digits, period), the codes produced will be identical to those from any standards-compliant app.
No. Your secret key exists only in your browser's memory while you actively use the tool. When you close the tab or click Clear, it is gone.
Nothing is saved to localStorage, no cookies are set for secrets, and no data is ever sent to any server. The only thing stored locally is your theme preference (light or dark mode), which contains no sensitive information.
Three HMAC algorithms are supported:
- SHA-1 — the default for most services, including Google Authenticator
- SHA-256 — used by some security-focused services
- SHA-512 — the strongest option, used by select services
You can also configure the number of digits (6 or 8) and the time period (default 30 seconds) under Advanced Options. Most services use SHA-1 with 6-digit codes and a 30-second period.
Yes. After the page loads, no internet connection is required. TOTP codes are calculated entirely from your secret key and the current time on your device.
You can disconnect from the internet and the tool will continue generating valid codes. This also serves as a way to verify the tool's privacy claims — no network activity means no data leaves your browser.
The most common causes are:
- Clock out of sync: TOTP codes depend on accurate time. Make sure your device's clock is set correctly, or enable automatic time synchronization in your system settings.
- Mismatched settings: The algorithm, number of digits, or time period may differ from what the other app uses. Most services use SHA-1, 6 digits, and 30 seconds, but some differ. Check your service's 2FA documentation.
- Incorrect secret key: Double-check for typos or missing characters. Base32 keys use only the letters A–Z and digits 2–7.
If none of these resolve the issue, try re-enrolling in 2FA for the service to get a fresh secret key.
If you lose your secret key, you will need to contact the service where you enabled 2FA and go through their account recovery process. Most services provide backup codes when you first set up 2FA — store those in a safe place.
Once you regain access, you can re-enroll in 2FA to get a new secret key. This tool does not store keys, so it cannot help you recover a lost one. Always keep a secure backup of your secret keys or backup codes.
Yes. The entire source code is available for inspection. You can view it directly in your browser's Developer Tools → Sources tab, or review the JavaScript files that power the TOTP generation.
Transparency is a core principle — you should never have to trust a black box with your authentication secrets. If you find an issue, contributions and reports are welcome.
Mobile authenticator apps store your secret keys persistently on your device and generate codes on demand. This browser-based tool does not store anything — you enter your key each time you need a code.
This tool is ideal as a backup when your phone is unavailable, for testing during development, or when you prefer not to install an app. For everyday use with many accounts, a dedicated authenticator app may be more convenient since it remembers your keys.
You can use this tool with any service that supports standard TOTP-based two-factor authentication (RFC 6238). This includes Google, GitHub, AWS, Dropbox, Facebook, Twitter/X, and thousands of other services.
If a service gives you a QR code or Base32 key during 2FA setup, it will work with this tool. The only exceptions are services that use proprietary push-notification-based 2FA (like Duo Push) instead of standard TOTP codes.
TOTP (Time-based One-Time Password) generates codes based on the current time and a shared secret. Codes change every 30 seconds (by default) and expire automatically. It is defined in RFC 6238.
HOTP (HMAC-based One-Time Password) generates codes based on a counter and a shared secret. Each code is used once and the counter increments. It is defined in RFC 4226.
TOTP is far more common today — it is what Google Authenticator, Authy, and most services use. TOTP is actually built on top of HOTP, using the current time step as the counter value. This tool generates TOTP codes.