# TOTP Generator

> Compute a time-based one-time password from a Base32 secret with HMAC-SHA, the same algorithm authenticator apps use (RFC 6238). Pick SHA-1, SHA-256, or SHA-512, 6 or 8 digits, and a 30- or 60-second step. The secret stays in the tab.

Runs in your browser. Nothing is uploaded.

[Crypto](https://toolbuddy.dev/categories/crypto.md)

## About this tool

Mint a time-based one-time password from a Base32 secret using HMAC-SHA, the same algorithm authenticator apps use (RFC 6238). Choose SHA-1, SHA-256, or SHA-512, six or eight digits, and a 30- or 60-second step. The code updates in this tab as the window moves.

How to use: paste the Base32 secret from a test user or from an otpauth setup. The sample is the public RFC 6238 test key, not an account secret. Copy the current code from the sticky bar. A mismatched algorithm, period, or digit count will not match the service you are testing.

Example: the sample secret with SHA-1, 6 digits, and a 30-second step produces the same code as a standard authenticator for that key. Use SHA-256 or SHA-512 only when the issuer says so. Most services still use SHA-1 and 6 digits.

The secret never leaves the tab. This page does not enroll a device, scan a QR code, or upload the key. Related: the Base32 encoder if you need to turn text into the alphabet this tool expects, and the HMAC generator for the underlying signature.

## FAQ

### Does the secret leave this page?

No. The TOTP code is computed with HMAC in the Web Crypto API in this tab. The secret is not uploaded, and the page does not enroll a device.

## Related Crypto tools

- [Hash Generator](https://toolbuddy.dev/tools/hash-generator.md): Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
- [HMAC Generator](https://toolbuddy.dev/tools/hmac-generator.md): Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
- [JWT Decoder](https://toolbuddy.dev/tools/jwt-decoder.md): Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.
- [JWT Encoder](https://toolbuddy.dev/tools/jwt-encoder.md): Sign a JSON object into a compact HS256, HS384, or HS512 JSON Web Token in the browser. The HMAC secret stays in the tab, so you can mint a test token without posting it to a hosted encoder.
- [AES Encrypt](https://toolbuddy.dev/tools/aes-encrypt.md): Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.
- [Secret Redactor](https://toolbuddy.dev/tools/secret-redactor.md): Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.