100% Client-Side

TOTP Generator

Generate time-based one-time passwords for two-factor authentication

Free Client-Side No Login No Storage
Loading tool...
HMAC Generator Generate HMAC message authentication codes — SHA256, SHA512, SHA1, MD5 SHA-1 Hash Generator Generate SHA-1 hashes — for legacy compatibility checks Password Strength Checker Real-time password analysis with entropy, crack time, and improvement tips

How to Use the TOTP Generator

  1. Enter your Base32 secret (from your authenticator app setup).
  2. Choose digits (6 or 8) and period (30s or 60s).
  3. Click Generate Code — auto-refreshes each period.

Uses HMAC-SHA1 per RFC 6238. Compatible with Google Authenticator, Authy, etc. Your secret never leaves your device.

What is TOTP Generator?

TOTP (Time-based One-Time Password) generates 6-digit codes that expire every 30 seconds — the same mechanism used by Google Authenticator and Authy. Based on RFC 6238 and used for two-factor authentication (2FA).

Common Uses

  • Testing 2FA integration during development
  • Verifying TOTP secret keys
  • Generating backup codes when authenticator app is unavailable

Frequently Asked Questions

What is a TOTP Generator?

TOTP (Time-based One-Time Password) generates 6-digit codes that expire every 30 seconds — the same mechanism used by Google Authenticator and Authy. Based on RFC 6238 and used for two-factor authentication (2FA).

Why use Aya Corporation?

Your TOTP secret key is extremely sensitive. Aya Corporation generates codes entirely client-side — your secret never touches a server. Safe for testing 2FA implementations during development.

When to use

Testing 2FA integration during development, verifying TOTP secret keys, or generating backup codes when your authenticator app is unavailable.

Notes from this implementation

Time, step, and the shared secret

TOTP (RFC 6238) is HMAC of a counter, and the counter is the Unix time divided by the step, usually 30 seconds. This page needs the Base32 secret your authenticator would store, the time on the machine, and the same step, digits, and hash (usually SHA-1, six digits) the server uses. If your laptop clock is four minutes off, the code will be wrong even when the secret is right. That is a clock problem, not a bug in the HMAC.

The secret is the long-term credential. The six-digit code is only good until the step rolls. Pasting a production secret here puts it in page memory. Use a disposable secret from a test account when you are learning the parameters.

What this is not

It does not scan a QR code image by itself unless the form has a decoder wired up, and it does not register the secret with a website. The enrollment QR is just the secret plus the issuer label, encoded as an otpauth:// URL.