totp-generator is a lightweight offline TOTP generator based on RFC 6238, ideal for developers, testers, and security engineers.
It works entirely offline and is perfect for debugging or validating your backend's TOTP implementation.
If you prefer generating TOTP codes directly in your browser with no installation, try:
TOTP Generator Online: tool.tl/totp-generator
It is simple, cross-platform, and great for quick testing.
Yes, Base32 is the common encoding used by most TOTP/2FA apps.
It's recommended primarily for development and testing rather than as the main end-user 2FA app.
Some implementations can parse otpauth:// URIs or QR codes.
Both the CLI version and the online tool at tool.tl/totp-generator provide quick and reliable ways to generate TOTP codes for development and testing.
TOTP is defined in RFC 6238 and builds on HMAC-SHA1. When you scan a QR code to set up 2FA, you receive a secret key (Base32-encoded, typically 160 bits). Your authenticator uses this key combined with the current 30-second time window (Unix timestamp divided by 30) as input to HMAC-SHA1, then extracts a 6-digit number from the hash output. The server performs the identical calculation and compares results. No network communication is required during code generation โ which is exactly why offline tools like totp-generator work correctly.
The weakest link in TOTP is typically the secret key storage, not the algorithm itself. Phone-based authenticator apps store the secret in the device's secure enclave, but the key is also exposed during the QR setup flow โ making screen recording or QR interception the most realistic attack vectors. For high-security environments, hardware tokens (YubiKey, etc.) are preferred because the secret never leaves the device. For most users, an offline software generator provides a solid middle ground without cloud sync risks.