# TOTP generator — time-based 2FA codes, no upload

> Free TOTP generator: turn an authenticator secret or QR image into live time-based 2FA codes with a rotation countdown, entirely in your browser — the secret stays on device.

Generate time-based one-time passwords from an authenticator secret or a scanned QR image, with a live countdown to the next rotation. The secret is used only in your browser, so it never leaves this device.

TOTP is the six-digit code behind most app-based two-factor auth: a shared secret plus the current time, hashed into a short number that changes every 30 seconds. Being able to compute it in the browser is handy for testing an integration or recovering access when your usual authenticator isn't at hand.

The countdown matters because a code entered in the last second of its window often fails validation on the far side; wait for a fresh one if you're close.

Store the underlying secret safely — a KeePass vault in the Password Desk is a good home — and gauge the strength of the passwords it protects with the Password strength checker.

## How to

1. **Add the secret.** Paste the Base32 secret or upload the setup QR image.
2. **See the code.** The current 6-digit TOTP is shown immediately.
3. **Watch the timer.** A countdown shows when the code rotates (usually every 30s).
4. **Copy & sign in.** Copy the code into the site's 2FA prompt before it expires.

## FAQ

### How do I get a TOTP code from a secret or QR?

Paste the Base32 secret, or drop the QR image from the setup screen; the tool computes the current time-based code and refreshes it on each rotation window.

### Is this a safe way to store my 2FA?

Treat it as a temporary or backup generator — anyone with the secret can produce codes. For everyday use, keep the secret in a dedicated authenticator or an encrypted vault, not lying around.

### Why is my code rejected?

TOTP depends on the clock; if your device time is off by more than the allowed drift, codes won't match. Confirm your system time is accurate and try the next window.

### Does the secret get uploaded?

No. The QR is decoded and the code is computed in this tab, so the shared secret is never transmitted to any server.


## Related tools

- [Password strength](https://www.safepaper.app/security/password-strength)
- [Password Generator](https://www.safepaper.app/passwords/password-generator)
- [Hash & checksum](https://www.safepaper.app/security/hash-verify)
- [AES file encrypt](https://www.safepaper.app/security/file-encrypt)

---

Canonical HTML: https://www.safepaper.app/security/totp
Markdown: https://www.safepaper.app/security/totp.md

There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check.