TOTP Code Generator (2FA Authenticator Codes)

Live 2FA authenticator codes from a TOTP secret.

otpauth:// URI (optional)

Base32 secret

Algorithm

Digits

Period (seconds)

Current code

–

Next code

–

Use via API

Generate the current and next TOTP (RFC 6238) codes for a Base32 secret, as an authenticator app would, plus an otpauth:// URI. Send JSON, get JSON back.

POST https://pithlab.com/api/v1/tools/totp-generator

curl https://pithlab.com/api/v1/tools/totp-generator \
  -H "Authorization: Bearer $PITHLAB_KEY" \
  -H "Content-Type: application/json" \
  -d '{"secret":"JBSWY3DPEHPK3PXP","time":1700000000}'

Fields and response OpenAPI document Get an API key

About the TOTP Code Generator

Generate time-based 2FA codes from a Base32 secret or otpauth:// URI, with a live countdown. Supports SHA-1, SHA-256 and SHA-512 with 6 or 8 digits.

How to use the TOTP Code Generator

Paste the Base32 secret shown when you set up two-factor login, or paste a full otpauth:// URI and press Load URI.
Leave SHA-1, 6 digits and 30 seconds unless the service says otherwise. These are the defaults almost everywhere.
The current code appears with a countdown. The next code is shown too, so you can prepare for a quick change.
Press Generate secret to create a fresh random secret for testing your own 2FA setup.

Examples

RFC 6238 test vector, SHA-1

Input

Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, time 59, 8 digits

Output

94287082

RFC 6238 test vector, later time

Input

Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, time 1111111109, 8 digits

Output

07081804

Six-digit code

Input

Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, time 59, 6 digits

Output

Frequently asked questions

Is it safe to paste my real 2FA secret here?

The codes are calculated in your browser and the secret is not sent or stored anywhere. Even so, a TOTP secret is as sensitive as a password. Do not paste real production secrets on a shared or untrusted computer, and clear the page when you are done.

Why is my code rejected?

TOTP codes depend on the clock. If your device time is off by more than about 30 seconds, codes will not match, so turn on automatic time. Also check the algorithm, digits and period match what the service uses.

What are TOTP and HOTP?

HOTP (RFC 4226) turns a secret and a counter into a short code using HMAC. TOTP (RFC 6238) uses the current time divided into 30-second steps as the counter, which is what authenticator apps show.

What does a generated secret contain?

20 random bytes (160 bits) from your browser's secure random generator, written in Base32. That is the size RFC 4226 recommends and what most services issue.