Paste your secret
Use a Base32 secret or a standard otpauth URI.
On-device calculation
A secure, fast online TOTP generator
Your 2FA secret is processed only in this browser. It is never uploaded or stored.
RFC 6238
No server requests
TOTP Tool
Current code
Remaining -- s
Scan local QR
The selected image never leaves this device.
This page contains no analytics, ads, third-party APIs, or network calls for TOTP secrets.
Simple by design
Get your code in three steps
Generate locally
Web Crypto calculates RFC 6238 TOTP entirely in this browser.
Copy and sign in
The code refreshes automatically at the end of every period.
Privacy architecture
Your secret stays yours
The public generator is intentionally isolated from the server. Its JavaScript does not send the secret, QR image, or generated code anywhere.
1No uploadTOTP computation runs in your browser.
2No storageSecrets never enter a database or session.
3No trackingNo analytics, advertising, or third-party CDN.
TOTP / RFC 6238
Works with the services you use
Google, Microsoft, GitHub, Cloudflare, Discord, Telegram, Binance, BT Panel, and most standards-compliant TOTP services.
Google
Microsoft
GitHub
Cloudflare
Discord
Telegram
Binance
宝塔
FAQ
Common questions
What is a 2FA secret?
It is the Base32 seed shared by a service and your authenticator. Anyone who has it can generate your codes, so protect it like a password.
Why does the code change every 30 seconds?
TOTP combines the secret with a time counter. Most services use a 30-second period.
Does this site save my secret?
No. On the public page, parsing, QR scanning, and TOTP generation happen only in your browser.
Why is my code rejected?
Check the secret, algorithm, digits, period, and the clock on your device. Even a small clock error can matter.
Does server time affect the public generator?
No. The public generator uses the clock on your current device, not the website server.
Does it support Google or Microsoft Authenticator?
Yes. Standard otpauth://totp URIs and SHA1/SHA256/SHA512 parameters are supported.