UsefulTab
TOTP / 2FA Code Generator
Live 6-digit 2FA codes from a secret.
Paste a secret to see the live code
Enter the Base32 secret from your 2FA setup, or the whole otpauth:// URI from its QR code. The current code, a countdown, and the next code appear instantly — all computed in your browser.
Runs entirely in your browser——————
Generate TOTP 2FA codes locally
TOTP (time-based one-time password) is the six-digit code an authenticator app shows for two-factor sign-in. Paste the Base32 secret a site gave you when you set up 2FA — or the whole otpauth:// URI behind its QR code — and this tool shows the current code, the seconds until it rolls over, and the next code, exactly as an authenticator app would. It supports 6 or 8 digits, 30-second or custom periods, and SHA-1/256/512. Every HMAC is computed in your browser with the Web Crypto API, so the secret never leaves your device. Treat it as a convenience and backup — a dedicated authenticator app on a separate device is still the stronger place to keep a long-lived 2FA secret.
Common questions
What do I paste — the secret or the QR code?
Either the Base32 secret key (the string of letters and digits a site shows when you enable 2FA, often grouped in fours) or the full otpauth://totp/... URI that its QR code encodes. If you paste an otpauth URI, the digits, period, and algorithm are filled in automatically.
Is my secret uploaded anywhere?
No. The secret stays in your browser tab. All HMAC and code generation run locally with the Web Crypto API, and nothing is sent to a server — which is also why it keeps working offline.
Why does the code change every 30 seconds?
TOTP derives the code from the current time divided into fixed windows (30 seconds by default). When the window rolls over, a new code is valid. The countdown shows how long the current code lasts, and the next code is previewed so you are never caught mid-rollover.
Can it replace my authenticator app?
It generates the same codes, so it works in a pinch and for testing. But a long-lived 2FA secret is safest in a dedicated authenticator app on a separate device — a code generator in a browser tab is best for development, verifying a setup, or a one-off.
Which algorithms and digit lengths are supported?
SHA-1 (the default almost every service uses), SHA-256, and SHA-512, with 6- or 8-digit codes and any period you set. These cover the RFC 6238 options real services issue.