Loading…
Loading…
Security tool
Generate time-based one-time passwords locally.
TOTP / 2FA Generator computes time-based one-time passwords (RFC 6238-style 6-digit codes, 30-second steps) from a Base32 secret using HMAC-SHA-1 in your browser. Handy for recovering a code when you understand the secret—without installing another authenticator app for a one-off check.
TOTP codes are short-lived numbers derived from a shared secret and the current time. Authenticator apps (and this tool) decode a Base32 secret, compute HMAC over a time counter, and display a 6-digit code that rotates every 30 seconds. Servers verify the same calculation within a small time window.
Everything here is client-side: the secret you paste is used only in the browser via Web Crypto HMAC. That is better than sending secrets to a remote “2FA generator” API—but the secret is still extremely sensitive. Anyone with the Base32 seed can mint valid codes. Never paste production root 2FA seeds into a third-party site if policy forbids it; prefer hardware keys or your approved authenticator for real accounts.
Clock skew matters: if your device time is wrong, codes will not match the server. This tool is for local generation and learning workflows, not a replacement for secure enrollment (QR provisioning, backup codes, and account recovery procedures).
ezToolFlow is operated by Vishvajeet Shukla. For privacy details on browser tools, accounts, and AI features, read our Privacy Policy.
Enter the shared TOTP secret (often shown as a Base32 string during 2FA setup). Use only secrets you are allowed to handle.
The tool computes a 6-digit code for the current 30-second window using HMAC-SHA-1 over the time counter.
Enter the code promptly on the verifying service. When the window rolls over, generate again.
Confirm a freshly provisioned secret produces codes that match your server’s TOTP library in a controlled environment.
Exercise login UIs with known test secrets in staging without wiring a full authenticator app.
Show how TOTP secrets and time steps produce rotating codes—using disposable demo secrets only.
If you already control the seed and accept the risk, generate a code locally; long term, store seeds in an approved authenticator or hardware device.
Tip: after you finish, check Related tools at the bottom of this page for the next step in your workflow.
Quick answers about tools, privacy, limits, and pricing.
No. Codes are computed in your browser with Web Crypto. The secret is not sent to our servers for generation.
Standard-style TOTP with HMAC-SHA-1, 6-digit codes, and a 30-second time step—matching common authenticator defaults.
Check device clock sync, Base32 secret accuracy (no spaces/O vs 0 mistakes), and that the server uses the same period and digits. Some systems expect a different hash or window.
Avoid it. Even with local processing, production authenticator secrets are high-value. Prefer your organization’s approved authenticator or hardware security keys.
No. Always save official backup/recovery codes during enrollment. This tool only generates the current TOTP from a secret you already have.
Yes. TOTP / 2FA Generator is free to use on ezToolFlow. Guests and free accounts may have daily limits on some tools; premium tiers can raise or remove those limits. AI tools may also spend credits.
For browser-based tools, processing runs on your device when possible and files are not uploaded for conversion. Optional accounts, usage limits, and AI features are described in our Privacy Policy.
No for most tools — you can start as a guest. An account helps keep higher daily limits and saved work (for example AI resumes).
Close other heavy tabs, use a smaller input file, and try Chrome or Edge on desktop. Very large files can stress browser memory.
Yes, the page is responsive. Complex media or large PDFs still work better on desktop because of memory and CPU limits on phones.
Keep working with similar free tools — no signup required for most.
Create strong, secure passwords with custom rules
Open toolGenerate SHA-1, SHA-256, SHA-384 & SHA-512 hashes from any text
Open toolSHA-256 hash of any file in-browser
Open toolHash and verify bcrypt passwords client-side
Open toolScore password strength with tips
Open toolGenerate secure random tokens
Open tool