In this article
What Is TOTP?
TOTP (Time-based One-Time Password) is a widely used algorithm for two-factor authentication. It generates a short numeric code — typically 6 digits — that changes every 30 seconds. The code is derived from a shared secret key and the current time, making it impossible to reuse or predict.
TOTP is defined in RFC 6238 and is supported by virtually every authenticator app including Google Authenticator, Authy, and Microsoft Authenticator. The shared secret is typically distributed as a Base32-encoded string or an otpauth:// URI that can be scanned as a QR code.
How Our Generator Works
CheckTown's TOTP Generator computes one-time passwords from a Base32 secret entirely in your browser. No data is ever sent to a server — your secrets stay private.
- Paste a Base32 secret or an otpauth:// URI — the tool parses it and extracts the parameters automatically
- See the current 6-digit code with a real-time countdown showing how many seconds remain before it expires
- Configure algorithm (SHA-1, SHA-256, SHA-512), period (30s or 60s), and digit count (6 or 8) for non-standard setups
Try it free — no signup required
Generate TOTP Code →When To Use a TOTP Generator
A standalone TOTP generator is essential for developers building or testing 2FA implementations, and for security-conscious users who want control over their second factor.
- Development testing — verify your TOTP implementation generates the same codes as standard authenticator apps
- Backup recovery — if you have the Base32 secret saved, generate codes without needing your phone or authenticator app
- Security auditing — test TOTP endpoints with different algorithms, periods, and digit counts to verify server-side validation
Frequently Asked Questions
Is it safe to paste my TOTP secret into a web tool?
CheckTown's TOTP Generator runs entirely in your browser using the Web Crypto API. Your secret never leaves your device — there are no network requests, no server-side processing, and no logging. You can verify this by checking the network tab in your browser's developer tools.
What is an otpauth:// URI?
An otpauth:// URI is a standardized format for sharing TOTP parameters. It encodes the secret, issuer, account name, algorithm, period, and digit count in a single URL. It is the same format encoded in the QR codes you scan when setting up 2FA. Example: otpauth://totp/Example:user@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
Why is my TOTP code different from my authenticator app?
The most common cause is a clock difference. TOTP codes depend on the current time — if your device clock is off by even 30 seconds, the codes will not match. Check that your system time is synchronized. Other causes include using the wrong algorithm (SHA-1 vs SHA-256) or period (30s vs 60s).