How to generate a TOTP code
- Paste the secret key that a website showed you when you set up two-factor authentication (the text under the QR code), or paste a full
otpauth://link. - The current six-digit code appears with a countdown, plus the next code. It matches what Google Authenticator, Microsoft Authenticator or Authy would show.
- Change the algorithm, number of digits or period only if the service says so; most use SHA-1, 6 digits and 30 seconds.
What TOTP is, and when to use this page
Time-based one-time passwords (TOTP, RFC 6238) are the six-digit codes from authenticator apps. The website and your app share a secret key; every 30 seconds both compute an HMAC of the current time slot with that key and turn it into a short number. Because the codes change constantly and are never sent in advance, a stolen password alone is not enough to sign in.
This page is useful for developers testing two-factor login, for checking that a secret key was saved correctly before you rely on it, and for recovering access when you kept a backup of the key but lost your phone. The code is calculated locally with the Web Crypto API and has been checked against the RFC 6238 test vectors. Your device clock must be accurate, since codes depend on the time.
For everyday sign-ins, keep using a dedicated authenticator app or password manager: a secret key should not live in a browser tab, and anyone who sees it can generate your codes. Treat backup keys like passwords.
Why does my code not work?
Usually the clock is off. Set your device to update the time automatically, check the key for typos, and confirm the digits and period.
Is it safe to paste my 2FA secret here?
The page never sends it anywhere, but any secret typed into a computer can be exposed by malware. Use it on a trusted device.
What is the difference between TOTP and HOTP?
HOTP codes change each time a counter increases; TOTP uses the current time as the counter, so codes expire.