TOTP Token Generator
Token GenerationProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool implements the TOTP algorithm as defined in RFC 6238, the same standard used by Google Authenticator and most two-factor authentication systems.
Algorithm Details
- Algorithm: TOTP (RFC 6238) = HOTP with time-based counter
- Underlying: HMAC-SHA1 (RFC 4226)
- Secret format: Base32 encoded (A-Z, 2-7)
- Time step: 15s, 30s (default), or 60s
- Output: 6, 7, or 8 digit numeric code
- Implementation: Web Crypto API — no external libraries
How TOTP Works
- The current Unix time is divided by the time step to get a counter value
- The counter is encoded as an 8-byte big-endian integer
- HMAC-SHA1 is computed:
HMAC(secret, counter) - Dynamic truncation extracts a 4-byte binary code
- The code is reduced modulo 10^digits to produce the final OTP
Time Window
The ±1 time window shows codes for the previous, current, and next time steps. This is useful for debugging clock synchronization issues between your device and the server.
Frequently Asked Questions
What is TOTP?
TOTP (Time-based One-Time Password) generates a short numeric code that changes every 30 seconds. It is defined in RFC 6238 and is the algorithm used by Google Authenticator, Authy, and most 2FA apps.
What is the difference between HOTP and TOTP?
HOTP is counter-based (each code increments a counter), while TOTP is time-based (each code is derived from the current Unix time divided by a time step). TOTP is what most 2FA apps use day-to-day.
Why does the time window show Previous and Next codes?
If your device clock is slightly out of sync with the server, the Previous or Next code may match instead of the Current one. Servers typically accept codes within a ±1 window to tolerate clock drift.
Is the secret sent to any server?
No. All TOTP computation happens locally in your browser using the Web Crypto API. Your shared secret never leaves your device.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.