Generate Time-based One-Time Password codes from a secret key, compatible with Google Authenticator and Authy.
This tool computes the six-digit code an authenticator app would show, from the base32 secret key you saved when you enrolled an account. Generation follows the standard TOTP scheme: the secret and the current time are combined in 30-second windows, so the code changes twice a minute and the math needs no network connection. What trips people up is that the code is deterministic, not random - the same secret yields the same code at the same moment on any device, and there is nothing to resend. If a code is rejected, the problem is the secret, the clock, or the window, not the tool.
A concrete input and expected output from the current implementation.
Input
GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ - the base32 form of the RFC 6238 test secret '12345678901234567890'
Expected output
005924 - the code for the window at Unix time 1234567890 (counter 41152263, 2009-02-13 23:31:30 UTC); the page shows whichever window is current when you generate
The code is a function of secret and time, so the live value rolls over every 30 seconds and cannot be quoted here. This pair is the published RFC 6238 test vector for that secret and counter, so it is exactly what the tool produces whenever the window reaches that counter; the leading zero shows the zero-padding step.
Generation follows RFC 6238. The pasted secret is base32 text (RFC 4648) that decodes to key bytes; Unix time in seconds, divided by 30, gives a counter; HMAC-SHA1 of the 8-byte counter with the key yields a digest from which a 31-bit slice is taken, reduced modulo 1,000,000, and zero-padded to six digits. Any implementation using the same formula shows the same code for the same secret.
The counter is the integer part of Unix time in UTC seconds divided by 30, so each code lives inside its own 30-second window and the window boundaries are shared by every device. A clock that is even a minute fast or slow produces codes a service rejects, while a correct clock matches. There is no per-user offset to synchronize and no server involved in generating the code.
If you saved the base32 secret when you enrolled, yes: the tool computes the same code your phone would, and you can complete login from any device with that code. If you never kept the secret, no generator can recover it - the secret is the only thing the code is derived from, and this page never sees your account or its server.
Usually one of three things: the 30-second window rolled over while you were copying the digits, the device clock is more than a step or two off from real time, or the secret was typed with an error. RFC 6238 recommends allowing at most one time step of delay, but services implement different tolerances; regenerate and enter the code promptly, and check the clock.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.