Random passwords from letters, digits and symbols via crypto.getRandomValues.
TOTP Code Generator
Runs locally
Use TOTP Code Generator
What it does
Compute the current time-based one-time password for a Base32 secret, the way authenticator apps do: six digits, 30-second steps, HMAC-SHA-1. Useful for testing your own 2FA setup.
It runs entirely in your browser: nothing you enter is uploaded.
Example
RFC 6238 test secret
GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ412568This is the published RFC 6238 test key 12345678901234567890 in Base32. The page shows its current six-digit code and the seconds until the next one, the same code an authenticator app shows for this secret.
FAQ
What exactly does it compute?
The current time-based code for a Base32 secret with HMAC-SHA-1, 30-second steps and 6 digits, the defaults of most authenticator apps. There is no HOTP counter mode, no SHA-256 or 8-digit option and no field to verify a code, and characters outside A-Z and 2-7 are skipped silently.
Does a TOTP code protect me from phishing?
Not fully. Adversary-in-the-middle phishing kits pass the code to the real site as you type it, so it is captured together with the password; passkeys and FIDO2 security keys resist this because they are tied to the real domain.
Is the secret sent or stored anywhere?
No. Codes are computed in your browser with the Web Crypto API and the secret is never uploaded or saved. The result depends on your device clock, so a clock that is off gives different codes.