Generate RFC 6238 two-factor authentication TOTP verification codes with dynamic 30-second countdown timers, QR scanning, and local accounts.
Use demonstration or development-account secrets when learning the interface. Codes depend on both the secret and the current time.
There is no single permanent expected code for this secret. Different timestamps produce different counters, so compare implementations during the same window.
If they differ, check the secret, algorithm, digit count, period, and clock first. Do not copy a demonstration secret into a real account.
Possession of a TOTP secret permits generating its codes. Verify account support and browser storage behavior before entering a sensitive secret.
The Free TOTP / 2FA Authenticator is an emergency browser-based two-factor authentication token generator and QR code inspector built on the RFC 6238 standard. Whether you have misplaced your primary mobile authenticator device, need to verify two-factor authentication during automated web development testing, or want to audit your secret key backup seeds, this tool computes identical 6-digit verification codes to Google Authenticator, Microsoft Authenticator, and 1Password.
Security-critical authentication tokens should never depend on remote cloud servers. Our authenticator executes HMAC-SHA1 cryptographic hashing strictly within your browser via the hardware-accelerated Web Crypto API. Enter raw Base32 secret seeds or upload an authenticator QR code screenshot to automatically parse otpauth:// URI schemes. An animated 30-second countdown indicator visualizes the current time window, allowing you to copy fresh tokens with a single click.
Save and label accounts securely in your local browser localStorage with zero server tracking. The tool also displays the upcoming token for the next time slice, eliminating race conditions when logging into services right as the current 30-second verification period expires.
Paste your raw Base32 secret seed string or upload an authenticator QR code image. The tool decodes the seed and issuer metadata instantly.
Observe the animated 30-second progress ring tracking the synchronized RFC 6238 time step relative to standard Unix epoch time.
Click the generated 6-digit code or copy button to paste into your login challenge. Code auto-refreshes seamlessly on the next cycle.
Store multi-account profiles locally in your browser storage with custom labels, or clear credentials at any time for total privacy.
Standard HMAC-SHA1 calculation matching Google Authenticator, Authy, and hardware YubiKey TOTP implementations.
Built-in client-side QR scanner parses otpauth://totp/ URIs to extract secret seeds, account labels, and issuers automatically.
Real-time circular progress indicator synchronized with system clock intervals, previewing upcoming tokens to avoid timeouts.
Accounts are optionally persisted in your private browser localStorage with zero external cloud sync or credential transmission.
TOTP codes depend on precise device time synchronization. Ensure your local clock matches internet time when verifying tokens, and store seed backups in secure cold storage.
Use a disposable account to compare generated codes with a service using compatible TOTP parameters.
Observe the countdown and explain why a code near a window boundary may expire before it is entered.
| Specification Parameter | Standard Value (RFC 6238) | Security & Interoperability Role |
|---|---|---|
| Time Step Interval (X) | 30 seconds | Determines validity window; balances user entry time against replay risk |
| Epoch Reference (T0) | Unix Epoch (1970-01-01T00:00:00Z) | Global time synchronization basis computed as floor(UnixTime / 30) |
| Hash Algorithm | HMAC-SHA1 (RFC 2104) | Standard for Google Authenticator; HMAC-SHA256 and SHA512 also supported |
| Secret Encoding | Base32 (RFC 4648) | Omits digits 0, 1, 8, 9 to avoid transcription errors during manual entry |
| Truncation Length | 6 decimal digits (HOTP RFC 4226) | Extracts 31-bit integer via dynamic truncation mod 1,000,000 |
| Time Skew Window | ±1 step (±30s tolerance) | Accommodates minor clock drift between client device and server NTP |
TOTP combines a shared secret key with the current Unix timestamp divided into 30-second steps. It applies HMAC-SHA1 hashing to the time counter and truncates the resulting hash into a 6-digit decimal number matching your authentication server.
TOTP algorithms rely on strict clock synchronization. If your computer system clock differs by more than 30 to 60 seconds from actual internet time (NTP), the generated tokens will be out of sync. Ensure your device time is set to sync automatically.
No. All calculations are executed locally inside your browser runtime. No secret keys or generated codes are sent across the network or saved to remote databases.
Base32 is an encoding format using letters A-Z and digits 2-7. It is standard for TOTP setup because it avoids easily confused characters like 0, 1, 8, and special symbols, making manual typing straightforward.
An internet connection is required to open tools and refresh a temporary session. Processing stays on your device; the handshake sends a random challenge, not files or text inputs. Libraries, fonts or models may download. Local processing cannot remove risks from an untrusted device or extension.
