TOTP Code Guide: How Time-Based Codes Work
Learn how a shared secret and the clock combine into a short-lived six-digit code.
What is the TOTP Authenticator Code Generator?
Enter the base32 secret from an authenticator setup and this tool decodes it, combines it with the current 30-second time step, and computes a 6-digit code using HMAC-SHA1, as defined by the TOTP standard. It also shows how many seconds remain in the current step, since the code changes when the step rolls over. The code is computed in your browser; keep your secret private and never paste it into a page you do not trust.
How to use it
- Copy the base32 secret from your authenticator setup.
- Paste it into the secret box.
- Click Generate Code and use the code before its seconds run out.
Worked example
For the sample secret, the tool shows a 6-digit code plus the seconds remaining in the current 30-second step; the code itself varies with the time step and changes when the step rolls over.
Why must my device clock be accurate?
Because the code depends on the current 30-second step. A clock that is far off lands in a different step and produces a code the server will not accept.
Frequently asked questions
Why does the code change every 30 seconds?
Because TOTP mixes your secret with the current time step, so the same secret yields a new code each step and old codes expire.
What if WebCrypto is unavailable?
The tool says so plainly instead of faking a code, since the HMAC computation needs that browser feature.