TOTP Generator implements RFC 6238 time-based one-time passwords in the browser using Web Crypto HMAC-SHA1. Paste a base32 secret or generate one, then watch the 6-digit code and countdown update each second.
What TOTP Generator does
Produces live TOTP codes and otpauth URL text.
- Base32 secret input or generate
- 6-digit code with countdown
- Optional account and issuer for otpauth
- Copy code or URL
Who TOTP Generator is for
- Developers testing MFA flows
- Admins verifying backup secrets
- Students learning TOTP
- Engineers debugging authenticator apps
How to use TOTP Generator
1. Paste a base32 secret or click Generate secret.
2. Optionally set account and issuer.
3. Read the live code and countdown.
4. Copy the code or otpauth URL text.
Features
- HMAC-SHA1 via Web Crypto
- 30-second time step
- otpauth://totp URL builder
- Local only
Examples
- Verify a staging MFA secret.
- Show students how the window rolls.
- Copy otpauth text to document a demo issuer.
Tips and limits
- Clock skew on the device affects codes.
- Not a replacement for a hardware key.
- Keep production secrets out of shared machines.
- QR rendering is not included; copy the URL text instead.
Related tools
FAQ
Which algorithm?
HMAC-SHA1 with 6 digits and a 30 second step, matching common authenticator defaults.
Is my secret uploaded?
No. Codes are computed locally.
Extra notes
TOTP Generator runs entirely in your browser so drafts and secrets never need to leave your device for processing. Keep a backup of long outputs in your own notes if you rely on them for production servers or live events. Accessibility friendly labels come from the module UI strings, and the layout follows the shared BeeForge .bf-tool shell for consistent spacing and buttons.
Support for developers, marketers, and everyday users is the same client-side model: open the page, configure options, copy or download, then paste into your workflow. BeeForge related links on the tool page point to companion utilities so you can move between related generators without hunting the hub.
When you share results with a teammate, paste into a ticket or gist rather than screenshotting alone, so the text remains searchable. If a browser privacy mode blocks clipboard helpers, select the output manually. Local processing also means the tool works offline after the page and scripts have loaded once.
Validate generated configs or hashes in a staging environment before production use. Prefer regenerating secrets after any accidental paste into chat. For teaching sessions, walk through one sample input end to end so students see how live updates and copy buttons behave together.