Open the Vootkit workspace.
01Privacy toolTool result
2FA / TOTP Code Generator
Generate the current 6-digit authenticator code from a secret.
100% FreeRuns instantlyNo watermark
- 1Choose toolOpen the Vootkit workspace.
- 2Add inputProvide the content or settings.
- 3ProcessLet the browser do the work.
Private by designProcessed on your device where possible.
Works on any deviceDesktop, tablet and mobile browsers.
No installationOpen the page and start working.
Always free coreUse the free plan for everyday tasks.
How to use 2FA / TOTP Code Generator
Provide the content or settings.
02Let the browser do the work.
03Copy, download or continue.
04Your files stay private
Your work is processed locally in your browser where possible and is never added to a Vootkit upload library.
Learn more about privacyTwo-factor codes are the same six digits your authenticator app shows, generated from a shared secret and the current time. Understanding that is what tells you why the codes fail when a clock drifts.
What 2FA / TOTP Code Generator does
Computes TOTP codes using HMAC-SHA1 on a 30-second step, producing 6 digits — the standard every mainstream authenticator implements.
The code depends on the current time, which is why a device with a clock more than a minute out generates codes that are silently rejected.
The algorithm
| Standard | TOTP (RFC 6238) |
|---|---|
| Hash | HMAC-SHA1 |
| Time step | 30 seconds |
| Digits | 6 |
| Secret format | Base32 — as printed under a QR code |
| Implementation | Browser Web Crypto — no library, no network |
| Depends on | Your device clock being accurate |
| <strong>Storage</strong> | <strong>None — this is not a replacement for an authenticator app</strong> |
Detailed steps
- Paste the base32 secret — the string shown under the QR code during setup.
- Read the current code.
- Use it before the 30-second window closes.
Worth knowing
This is useful for testing a TOTP setup or recovering access when your authenticator is unavailable — it is not a place to keep your secrets. It stores nothing, so you would be pasting a secret each time, and a secret that lives in your clipboard and browser history is a secret with a much larger attack surface than one inside an app.
Frequently Asked Questions
My code is rejected as invalid.
Almost always clock drift. TOTP is computed from the current time, so a device more than about a minute off generates codes the server will not accept. Enable automatic time sync and try again.
Why SHA-1 — is that not broken?
SHA-1 is broken for collision resistance, which HMAC does not depend on. HMAC-SHA1 remains secure for this purpose and is what RFC 6238 specifies, so every mainstream authenticator uses it. Changing it would break compatibility for no security gain.
Should I use this instead of an authenticator app?
No. It keeps nothing, so you would paste your secret in every time — putting it in your clipboard and possibly your history. Use a real authenticator for daily use and this for testing or emergency access.
Is my secret transmitted?
No. Codes are computed with the browser’s Web Crypto on your device, and nothing is sent anywhere.
Is 2FA / TOTP Code Generator free?
Yes. The Vootkit free plan includes 5 tool runs a day. Upgrade to Vootkit Pro for unlimited daily use, an ad-free workspace and saved workflows.
Are my files uploaded?
No. 2FA / TOTP Code Generator runs entirely in your browser — your file is processed on your own device and never sent to a server. There is nothing for us to store or delete.
Do I need to install anything?
No. 2FA / TOTP Code Generator works in any modern browser on desktop, tablet or phone. Open the page and start.
How often can I use it? Is there a daily limit?
On the free plan you get 5 tool runs a day. When you reach the limit you'll see a prompt to upgrade, and it resets the next day. Vootkit Pro removes the cap entirely for unlimited daily use.
Recently viewed
This tool processes everything locally in your browser. You can disconnect from the internet after the page loads and it will still work.