All tools

TOTP / HOTP Code Generator

Code

Generate the current TOTP code (RFC 6238) from a base32-encoded shared secret, or an HOTP code (RFC 4226) for a specific counter value, with 6-8 digits and SHA-1/SHA-256/SHA-512

Verifying a two-factor login integration usually means reaching for your phone every time you need a fresh code. This tool generates the same TOTP code your authenticator app would show, live, from the same base32 secret you'd scan as a QR code, plus a countdown until it rotates. It also covers the less common HOTP mode, where the code depends on an explicit counter rather than the clock, for testing counter-based flows like some hardware tokens use. The secret never leaves your browser or gets stored anywhere.

totphotp2faauthenticatorotprfc6238rfc4226

How to use TOTP / HOTP Code Generator

  • 1.Paste the base32 shared secret from your 2FA setup screen (the same string encoded in the QR code), or click a sample secret to try it.
  • 2.Switch between TOTP for a live, auto-rotating time-based code, or HOTP to generate a code for a specific counter value.
  • 3.Adjust digit count and hash algorithm if your integration uses non-default settings; most authenticator apps use 6 digits and SHA-1.

Frequently asked questions

Is my secret sent anywhere?
No. The browser tool computes the HMAC locally using the Web Crypto API, and the REST API/SDKs use the same one-shot HMAC computation server-side without persisting the secret.
Why does my code not match my authenticator app?
Check that the digit count, algorithm, and period all match what your app expects (6 digits, SHA-1, 30-second period is the near-universal default), and that your system clock is accurate, since TOTP is entirely time-derived.
What's the difference between TOTP and HOTP?
TOTP derives its counter from the current time divided by a period (usually 30s), so the code rotates automatically. HOTP uses an explicit counter you control, which increments after each use rather than on a timer.
Does this replace a real authenticator app?
No, it's a testing and debugging tool for developers integrating 2FA, not a place to store a production secret long-term.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/totp-hotp-generator \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"mode":"totp","secret":"GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ","digits":6,"algorithm":"SHA1","periodSeconds":30}'

Get an API key from your dashboard · Full API docs →