TOTP / 2FA code simulator
Generate time-based one-time codes, like an authenticator app, from a secret.
Runs on your device · nothing is uploaded
------
New code in 30 s. Use a demo secret only: never paste the secret for a real account into any website.
How authenticator codes work
A time-based one-time password (TOTP, RFC 6238) is made from two things: a shared secret saved when you scan the QR code, and the current time. Every 30 seconds the time step changes, the app runs HMAC-SHA1 over the step number with the secret, and turns part of the result into a 6-digit code. The server does the same calculation, so the codes match without anything being sent.
- Codes depend on accurate clocks, so servers usually also accept the previous and next code.
- The secret is the real key: anyone with it can make valid codes forever. Keep it secret and never paste a real one into a website.
- TOTP is far stronger than SMS codes, but it can still be phished in real time. Passkeys and security keys resist phishing completely.