# TOTP Code Generator

URL: https://phishdestroy.io/developer-tools/totp-hotp-generator
Category: Personal security
Where it runs: Runs locally (nothing you enter is uploaded)

Compute the current time-based one-time password for a Base32 secret, the way authenticator apps do: six digits, 30-second steps, HMAC-SHA-1. Useful for testing your own 2FA setup.

## Example input

RFC 6238 test secret

```
GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
```

This is the published RFC 6238 test key 12345678901234567890 in Base32. The page shows its current six-digit code and the seconds until the next one, the same code an authenticator app shows for this secret.

## FAQ

### What exactly does it compute?

The current time-based code for a Base32 secret with HMAC-SHA-1, 30-second steps and 6 digits, the defaults of most authenticator apps. There is no HOTP counter mode, no SHA-256 or 8-digit option and no field to verify a code, and characters outside A-Z and 2-7 are skipped silently.

### Does a TOTP code protect me from phishing?

Not fully. Adversary-in-the-middle phishing kits pass the code to the real site as you type it, so it is captured together with the password; passkeys and FIDO2 security keys resist this because they are tied to the real domain.

### Is the secret sent or stored anywhere?

No. Codes are computed in your browser with the Web Crypto API and the secret is never uploaded or saved. The result depends on your device clock, so a clock that is off gives different codes.

## Related tools

- [Password Generator](https://phishdestroy.io/developer-tools/password-generator)
- [Passphrase Generator (BIP39 Words)](https://phishdestroy.io/developer-tools/passphrase-generator)
- [Pwned Password Check](https://phishdestroy.io/developer-tools/pwned-password-check)
- [HMAC Generator](https://phishdestroy.io/developer-tools/hmac-generator)
- [AES-GCM Encrypt / Decrypt](https://phishdestroy.io/developer-tools/aes-gcm-encryption)

All tools: https://phishdestroy.io/developer-tools