Cryptography
TOTP 2FA Code Generator
Paste the Base32 secret from an authenticator QR code and watch the six-digit code roll every 30 seconds -- useful for testing MFA setups, debugging enrolment and teaching how TOTP actually works.
The secret is used only by your browser's Web Crypto API. Never paste a production MFA secret into any website you do not fully control -- use a throwaway test secret instead.
How TOTP works
- A shared secret plus the current 30-second time step is run through HMAC-SHA1 (RFC 6238).
- The result is truncated to six digits, so both the server and your app derive the same code without ever exchanging it.
- Clock drift is the usual cause of 'invalid code' errors -- most servers accept one step either side.
- TOTP is phishable: an attacker who relays your code in real time can still get in. Passkeys or hardware keys are stronger.
Related tools
Password Strength Checker
Analyse password length, character variety and weak patterns locally in your browser.
Regex Tester
Test regular expressions against sample text with live match highlighting.
Password Generator
Create strong random passwords with adjustable length and character sets, generated locally.