What is TOTP and how does Time-Based One-Time Password work?

TOTP (Time-Based One-Time Password, defined in RFC 6238) computes an HMAC hash using a shared secret key and the current Unix timestamp rounded to 30-second time steps. The hash is dynamically truncated to produce a 6 or 8-digit code that changes every 30 seconds.

Is it safe to generate 2FA codes in this web app?

Yes. All computations run 100% locally in your browser memory using the Web Cryptography API. Secrets are never sent to our servers or stored in cookies.

What should I do if my 2FA token is rejected due to clock drift?

TOTP requires synchronized clocks. If your device's system time differs from standard NTP time by more than 15-30 seconds, verify your system clock settings.

Security & Crypto

TOTP 2FA Authenticator & Generator

Generate and verify live RFC 6238 Time-Based One-Time Passwords with interactive 30-second countdown.

Quick Answer & Summary

A TOTP (Time-Based One-Time Password) authenticator calculates dynamic numerical 2-factor authentication codes by combining a shared Base32 secret key with the current Unix epoch time in 30-second intervals.

RFC 6238 TOTP Algorithm Formula

T = ⌊ (Current_Time_Seconds - T0) / X ⌋ | TOTP = Truncate( HMAC-SHA(K, T) ) mod 10^Digits

Where T0 = 0 (Unix epoch), X = 30 seconds time step, K is the shared secret key, and Truncate extracts a 4-byte dynamic integer.

Live 2FA Security Code

RFC 6238 Standard

000 000

Next code in:30s

2FA Account Configuration

Base32 Secret Key

Accepts standard Base32 encoded keys used by Google Authenticator, Authy, and 1Password.

HMAC Algorithm

Token Digits

Time Step (Interval)

Verify Inbound 2FA Token

Simulate a backend login authorization check with ±1 step clock-drift tolerance.

Share This Tool

Help your team and fellow developers save time with free, private client-side utilities.

X (Twitter)LinkedIn WhatsApp Reddit Facebook

Toolbox Editorial TeamVerified Authors

Systems & Security Engineers • Applied Cryptography & High-Performance Web Tools

Updated: August 2026

100% In-BrowserZero server storage

Standards AuditedRFC & ISO compliant

Peer ReviewedEditorial Policy

Documentation & Guide

How to Use TOTP 2FA Authenticator & Generator

Input Base32 Secret Key

Enter your 16 or 32-character secret key or click 'New Secret' to generate a fresh test key.

Watch Real-Time OTP Generation

Observe live 6-digit or 8-digit verification codes refreshing automatically every 30 seconds.

Copy Code or Verify Inbound Tokens

One-click copy the active code or test verification against potential clock-drift intervals.

Practical Examples & Conversions

Input

Secret: JBSWY3DPEHPK3PXP, Step: 30s

Output

Live synchronized 6-digit 2FA token

Frequently Asked Questions (PAA)

Related Tools & Converters

HMAC Signer & Verifier

Cryptographic HMAC signatures

Password Generator

High-entropy random passwords

Unix Timestamp Converter

Inspect Unix epoch timestamps

QR Code Generator

Create otpauth:// 2FA QR codes

Authoritative Standards & Citations

Calculations and algorithms on this page are implemented and verified in strict accordance with the following official technical specifications:

IETF (Internet Engineering Task Force)

RFC 7519: JSON Web Token (JWT)

Standardized compact, URL-safe means of representing claims to be transferred between two parties.

W3C Recommendation

Web Cryptography API Specification

Standard JavaScript API for performing basic cryptographic operations in web applications.

IETF Standards Track

RFC 4122: A Universally Unique IDentifier (UUID) URN Namespace

Definition of uniform format and generation algorithms for UUIDs.