Generate time-based authentication codes locally from your own Base32 setup key.
Example
With the public test key from the RFC, the 6-digit SHA-1 code at 59 seconds is 287082 and stays 287082 until 59.999 seconds, then becomes 359152 at 60 seconds.
Calculation method
The generator implements the TOTP standard, RFC 6238: it divides the current Unix time by the selected period, combines that counter with your key using HMAC, and turns the result into 6 or 8 digits. Anyone with the same key, settings and correct time gets the same code.
Important notes
The key is treated like a password. It stays in this page’s memory, is not saved, logged or sent anywhere, and is cleared when you reset or leave. That still cannot protect against a compromised device or a malicious browser extension, so do not paste keys on shared computers.
What a time-based code is
Authenticator apps show a new code every 30 seconds using the TOTP standard, RFC 6238. The service and the app share a secret setup key; each divides the current Unix time by the period, combines that counter with the key using HMAC, and turns the result into 6 or 8 digits. Anyone with the same key, settings and correct time gets the same code. The examples use the public test key from the RFC: at 59 seconds after 1 January 1970 the 6-digit SHA-1 code is 287082, and it stays 287082 until 59.999 seconds.
Matching the settings and the clock
Enter the Base32 setup key exactly as the service provides it; spaces and lower-case letters are accepted, but a QR image, an SMS code or an otpauth link is not. Most services use SHA-1, 6 digits and 30 seconds, and a mismatch in any of them produces valid-looking but wrong codes: the same key and moment give 94287082 with 8 digits, 46119246 with SHA-256 and 90693936 with SHA-512. The code changes at each period boundary, so at 60 seconds it becomes 359152. Leading zeros matter, as in 081804, and must be typed.
Security boundaries of this page
The key is treated like a password. It stays in this page’s memory, is not saved, logged or sent anywhere, and is cleared when you reset or leave; the page loads no advertising or analytics scripts and blocks outgoing connections. That still cannot protect against a compromised device or a malicious browser extension, so do not paste keys on shared computers. Keep your service’s recovery codes safe, use a trusted authenticator app for daily sign-ins, and if a code is rejected, turn on automatic time on your device and try a fresh code.
Worked examples| Input | Result |
|---|
RFC key · SHA-1 · 6 digits · 30 s · at 59 s | 287082 |
RFC key · SHA-1 · 6 digits · 30 s · at 59.999 s | 287082 |
RFC key · SHA-1 · 6 digits · 30 s · at 60 s | 359152 |
RFC key · SHA-1 · 6 digits · 30 s · at 1111111109 s | 081804 |
RFC key · SHA-1 · 8 digits · at 59 s | 94287082 |
RFC key · SHA-256 · 8 digits · at 59 s | 46119246 |
RFC key · SHA-512 · 8 digits · at 59 s | 90693936 |
Frequently asked questions
My code is rejected — what should I check?
First the settings: most services use SHA-1, 6 digits and 30 seconds, and a mismatch produces valid-looking but wrong codes. The same key and moment give 94287082 with 8 digits, 46119246 with SHA-256 and 90693936 with SHA-512. Then turn on automatic time on your device and try a fresh code.
Which key formats are accepted?
Enter the Base32 setup key exactly as the service provides it; spaces and lower-case letters are accepted, but a QR image, an SMS code or an otpauth link is not. Never share your secret, and remember that copying a code places it on your device clipboard.
Does this back up or recover my accounts?
No. The page is not an account vault, backup or recovery service, so keep your service’s recovery codes safe elsewhere and use a trusted authenticator app for daily sign-ins. Leading zeros are part of the code, as in 081804, and must be typed.