Cryptography

TOTP 2FA Code Generator

Paste the Base32 secret from an authenticator QR code and watch the six-digit code roll every 30 seconds -- useful for testing MFA setups, debugging enrolment and teaching how TOTP actually works.

The secret is used only by your browser's Web Crypto API. Never paste a production MFA secret into any website you do not fully control -- use a throwaway test secret instead.

How TOTP works

  • A shared secret plus the current 30-second time step is run through HMAC-SHA1 (RFC 6238).
  • The result is truncated to six digits, so both the server and your app derive the same code without ever exchanging it.
  • Clock drift is the usual cause of 'invalid code' errors -- most servers accept one step either side.
  • TOTP is phishable: an attacker who relays your code in real time can still get in. Passkeys or hardware keys are stronger.