What is TOTP?
TOTP (Time-based One-Time Password) is a widely adopted algorithm that computes a one-time password from a shared secret key and the current time. It is defined in RFC 6238 and serves as the foundation for Multi-Factor Authentication (MFA) and Two-Factor Authentication (2FA) applications like Google Authenticator, Microsoft Authenticator, and Authy.
The algorithm uses a Base32 secret key shared between the authentication server and the client’s authenticator app. Both parties use the current UNIX time, divided into step intervals (typically 30 seconds), to generate matching numerical codes. Since the codes change dynamically based on time, they remain valid for only a short window, protecting user accounts even if a passcode is intercepted.
Key Features and Settings
This TOTP Generator simulates the exact interface of an authenticator app:
- Base32 Secret Key (Input Field): An input field that accepts a Base32 encoded secret key (e.g.,
JBSWY3DPEHPK3PXP). Changing the secret immediately regenerates a different stream of verification codes. - Active Verification Code Display: A large, easy-to-read numeric output displaying the 6-digit verification code. The code is formatted with a middle space (e.g.,
123 456) to enhance readability. - Dynamic Countdowns: A progress bar showing the remaining percentage of the current 30-second epoch.
- Time Status Text: Text displaying exactly how many seconds are left before the code resets (e.g.,
Code resets in 24 seconds).
Real-World Use Cases
- MFA/2FA Testing and Verification: When developing custom authentication flows, developers can paste their system’s generated Base32 secret keys into this tool to verify if their backend’s TOTP validation logic aligns with client-side code generations.
- Authenticator App Simulation: Running automated or manual testing cycles for security gates without needing physical mobile devices to read authenticator codes.
- Backup Key Recovery: Converting backup secret strings back into numerical verification codes if a developer loses access to their primary authenticator device.
Step-by-Step Guide to Using the TOTP Generator
- Provide a Base32 Secret Key: Input your application’s 2FA secret key in the Base32 Secret Key input field. A default helper secret (
JBSWY3DPEHPK3PXP) is prefilled to demonstrate the functionality. - Observe the Active Code: Look at the large 6-digit number displayed under the Active Verification Code header.
- Track the Timer: Watch the horizontal progress bar decrease. The numeric verification code automatically regenerates the moment the countdown timer hits 0.
- Copy the Code: Manually copy the 6-digit code (ignoring the space separator) and submit it into your login form or API testing client before the timer expires.