TOTP 2FA Code Generator: Free, No Sign-Up

A TOTP 2FA code generator turns the Base32 secret from a two-factor setup page into the same rotating 6 or 8 digit code an authenticator app shows. Paste your secret, choose a 30 or 60 second period, and get the current, previous and next codes with a live countdown. It is free and needs no sign-in.

What Is a TOTP Code?

A TOTP code is a one-time password that changes on a fixed schedule and is calculated from a shared secret and the current time. TOTP stands for Time-based One-Time Password and is defined in RFC 6238, which builds on the HOTP method in RFC 4226.

When you turn on two-factor authentication with an authenticator app, the service gives you a secret key, usually as a QR code or as a text string in Base32. Your app and the service's server both store that secret. Every 30 seconds, both sides divide the current time by the period to get a counter. They run that counter through an HMAC (SHA-1 is the standard default) and shorten the result to 6 digits. If both calculations match, the login is accepted.

Because the code depends on the clock, nothing is sent between you and the service except the digits you type. A stolen code is useless after its window ends.

What does Base32 look like?

Base32 uses only the capital letters A to Z and the digits 2 to 7. There is no 0, 1, 8 or 9. A typical secret looks like JBSWY3DPEHPK3PXP. Many services show it in groups of four characters with spaces, and the tool ignores spaces and lowercase letters when you paste it.

How to Use the TOTP 2FA Code Generator

You need only a Base32 secret and about ten seconds. Follow these steps:

1. Enter your secret in the TOTP Secret Key (Base32) field. Use the secret from your authenticator app setup page, or press Generate to create a random 32-character secret for testing.
2. Pick the Period (seconds): 30s (Standard) or 60s. Almost every service uses 30 seconds.
3. Pick Digits: 6 digits (the common default) or 8 digits.
4. Click Generate Live Code. The Current TOTP Code appears with a countdown of seconds left, plus the Previous Code and Next Code.
5. Use the copy button beside the code to copy it, then paste it into the login or setup form before the timer runs out.
6. Optional: fill in Account Name and Issuer / Service Name to build an OTP Auth URI, then use Copy to take it with you.

If you change any field after generating, the results clear. Click Generate Live Code again to refresh them.

Worked Example: From Secret to Code

Say a practice setup page gives you the secret JBSWY3DPEHPK3PXP. Enter it, keep 30 seconds and 6 digits, and click Generate Live Code.

The tool shows a code split into two groups of three, such as 482 915. The exact digits depend on the clock, so your screen will differ. Say the countdown reads 19. That means the code stays valid for 19 more seconds. The Previous Code is the one that was valid in the last 30-second window, and the Next Code is what you will see when the timer hits zero.

Now switch Digits to 8. The tool needs a new click on Generate Live Code, and it returns an 8 digit code for the same secret. This is a different number, not a longer version of the 6 digit one. The service you log in to must expect 8 digits, or the code will be rejected.

For the URI, type [email protected] as the Account Name and Acme as the Issuer. The OTP Auth URI field then fills with an address starting with otpauth://totp/Acme:, followed by your account, the secret, the issuer, SHA1, the digit count and the period. If you leave both fields empty, the tool uses [email protected] and MyApp as placeholders.

How Do You Read the Results?

Each part of the output answers one question, and the countdown matters most.

• Current TOTP Code: the code to type right now. Wait for a fresh window if fewer than 5 seconds remain. The ring turns red at that point as a warning.
• Seconds left: the time until the code changes. A short countdown means you may not finish typing in time.
• Previous Code: useful when a service has just rotated to a new window and your login still fails. Some services accept the adjacent code to allow for small clock differences, but never count on it.
• Next Code: lets you check what the following window will produce. It also helps when you compare against another device that is slightly ahead.
• OTP Auth URI: a single line that holds the secret, issuer, account, algorithm, digits and period. Authenticator apps that support importing by link or text can use it.

What the error messages mean

An error such as Invalid Base32 character means the secret contains a character outside A to Z and 2 to 7, often a zero typed instead of the letter O, or a one instead of the letter I. Invalid Base32 padding or Invalid Base32 padding bits usually means the secret was cut off or has extra characters at the end. A message asking for a valid Base32 secret means the field is empty, malformed or longer than 1024 characters.

Where Do You Find the Secret Key?

Most services show the secret during two-factor setup, right under the QR code. Look for a link or label such as "Can't scan the QR code?", "Enter a setup key" or "Manual entry". Searchers often ask how to get an authenticator code for Facebook. The steps are the same everywhere: open the account's security settings, choose the authentication app method, and copy the setup key shown next to the QR code.

The secret appears only during setup on many services. If you did not save it, you cannot read it back later. You would have to turn off two-factor authentication and set it up again, or use a recovery code to get in.

Who Is This TOTP Generator For?

The tool fits anyone who needs to see how a time-based code behaves or produce one from a secret they already hold.

• Developers: building a login flow and need a known-good code to compare against what the backend generates.
• QA testers: checking that a 2FA step accepts a valid code and rejects an old one, using the Previous and Next values.
• Site owners and admins: creating a test secret with the Generate button and an otpauth link for a staging account.
• Learners: students of security who want to watch a counter, a period and a digit count shape a code.
• People troubleshooting: anyone whose app shows a code that the service calls incorrect and who wants an independent check.

For related work, the bcrypt hash generator covers password storage, and the MD5 generator shows how hash functions turn input into fixed output. You can find more in the security and encryption tools collection.

Best Practices and Troubleshooting

Most failed codes come from a handful of causes, and each has a quick fix.

The service says the code is incorrect

• Check the clock first. TOTP depends on time. A device clock that is off by a minute or more produces codes the server will not accept. Turn on automatic time sync.
• Match the settings. The period and digit count must match the service. If the service expects 6 digits and you chose 8, the code fails.
• Check the secret. One wrong character gives a completely different code. Re-copy the secret instead of retyping it.
• Type quickly or wait. If the countdown is under 5 seconds, wait for the next window.

Handle secrets carefully

• Treat the secret like a password. Anyone who has it can produce valid codes forever.
• Do not keep the secret and your password in the same place. That removes the second factor.
• Save the service's recovery codes when you set up 2FA, so you can regain access if you lose the secret.
• Use the random Generate button only for testing. A real account needs the secret the service gave you.

Security hardening beyond 2FA

Two-factor codes protect logins, but they are one layer. If you run a website, a strong content security policy also helps reduce the risk of script injection on the pages where people sign in.

Limitations to Know About

This tool follows the standard TOTP method with the SHA-1 algorithm, 30 or 60 second periods and 6 or 8 digit codes. Services that use other algorithms, other periods or different code formats will not match. Some apps, such as those that show alphanumeric codes, use their own schemes that are not standard TOTP.

The codes depend on the clock of the device you use. The tool cannot fix a wrong system clock, and it cannot recover a secret you lost. It also does not scan QR codes: you need the text secret, not the image.

Use this TOTP 2FA code generator whenever you need a quick, standard code from a Base32 secret. Enter your secret above, set the period and digits to match your service, and click Generate Live Code to see your current, previous and next codes.