Generate TOTP codes from a secret, without the secret leaving your browser
Paste a base32 secret or an otpauth URL. The codes are computed with WebCrypto in your own browser, the countdown shows how long the current one is valid, and the drift between your clock and ours is shown, because a wrong clock is the usual reason a correct code is refused.
Paste the secret an authenticator app would scan, or the full otpauth:// URL from the QR code.
This tool runs in your browser and needs JavaScript.
Observations, not verdicts. What you enter is processed for this result and written to a usage journal described in the privacy policy; nothing else is stored.
How a TOTP code is computed, and why this page can do it offline
A time-based one-time password (RFC 6238) is an HMAC over a counter, where the counter is the current Unix time divided by the period, usually 30 seconds. The key of the HMAC is the shared secret, the base32 string an authenticator app stores when it scans the QR code. The HMAC output is truncated to six or eight digits by the method RFC 4226 describes for HOTP. That is the whole algorithm, and every part of it is available in a browser: SubtleCrypto signs the HMAC, the page's clock supplies the counter, and the rest is arithmetic.
What the tool shows
The current code, the next one, and a countdown to the boundary. The parameters are read from the otpauth URL when you paste one and can be set by hand otherwise: algorithm (SHA-1 by default; SHA-256 and SHA-512 are supported by some issuers), digits (six or eight) and period. The label and issuer from the URL are displayed so you can see which account the secret belongs to.
Clock drift is the one thing a page cannot compute alone. The tool makes a single request to this site that carries no secret and no code, reads the server's time from the response, and displays the difference to your device clock. A drift beyond a few seconds explains most cases of a correct code being rejected: authenticator servers typically accept one step either side, so a clock that is a minute off produces codes that are always valid for the wrong window.
What never leaves the page
The secret, the otpauth URL and the generated codes stay in the browser tab. No request carries them, there is no server-side generation, and closing the tab discards them. That is verifiable from the network panel of the developer tools, which is the appropriate way to check a claim like this rather than taking it on trust.
What the tool is for is testing: a developer who has just added TOTP to a login and wants to check the server accepts codes; someone setting up an automated login who needs to confirm that the secret in the vault is the right one before an agent uses it. What it is not for is being your authenticator app. A browser tab has no backup, no device binding and no lock screen.
How the vault uses a TOTP secret
A Browserberg credential can carry a TOTP secret next to the password. At login, the vault computes the current code and types it into the field through a placeholder, the same way it types the password. The agent that drives the login asks for the code by placeholder and never sees the secret or the code; the model's context contains neither. Release is site-scoped, so a secret stored for one portal is never typed on another, and a code consumed in one run is not reused in the next.
Parameters the generator understands
| Secret | Base32 (RFC 4648), with or without padding and spaces; also read from the secret parameter of an otpauth URL |
|---|---|
| Algorithm | SHA-1 (default, what most issuers use), SHA-256, SHA-512 |
| Digits | 6 (default) or 8 |
| Period | 30 seconds by default; any value from the otpauth URL |
| Clock drift | Difference between your device clock and the server's, from one request that carries neither secret nor code |
| Where it runs | Entirely in your browser with SubtleCrypto; no server-side generation, nothing stored |
As of 2026-09-08
Testing a 2FA login with it
-
Get the secret from the setup screen
Most services offer a text version of the QR code, labelled setup key or manual entry. If not, the QR code decodes to an otpauth URL, which the tool reads whole.
-
Check the parameters
Algorithm, digits and period are taken from the URL. When you have only the raw secret, leave the defaults; nearly every issuer uses SHA-1, six digits and thirty seconds.
-
Compare with the authenticator app
The code shown here should match the app's code for the same account at the same moment. A mismatch with zero drift usually means a different secret; a mismatch with drift means a clock.
-
Store the secret where the agent can use it
For an automated login, put the secret into the credential in the vault. The agent gets a placeholder; the vault types the code.
Questions about TOTP codes
What is a TOTP code?
A six- or eight-digit number derived from a shared secret and the current time, valid for one period (usually 30 seconds). Authenticator apps compute it locally; the server computes the same number and compares.
Is it safe to paste a secret here?
The secret stays in the browser tab; no request carries it, and you can confirm that in the network panel. Even so, use a test account's secret where you can, because a browser tab is not a place to keep a production secret.
Why does the server reject a code that this page shows?
Check the drift shown beside the countdown. Servers accept only a narrow window of time steps, so a device clock that is off by a minute produces codes the server has already expired. The other cause is a wrong secret.
Can I use this as my authenticator app?
You should not. There is no backup, no device binding and no lock. It is for testing that a secret and a server agree.
How does an agent log in with 2FA?
The credential in the vault carries the TOTP secret. At login the vault computes the code and types it via a placeholder, so the model never sees the secret or the code. For pushTAN or SMS codes, a person supplies them through live-view takeover.
Related tools and guides
- Credentials vault How secrets and TOTP are stored, released per site and typed through placeholders
- Live view and takeover For the second factors a machine cannot compute: pushTAN, SMS, hardware keys
- Credentials reference The API for creating, listing and revoking a credential
- Audit log verifier Check the signed log of a run that used a vaulted credential
Let the vault type the code
Five browser hours, no card. Store a credential with its TOTP secret and run a login the model never sees the secret of.