2FA Auth Code Generator

About 2FA & Time-Based One-Time Password (TOTP / OTC)

Two-Factor Authentication (2FA) adds an indispensable layer of cybersecurity to user accounts. Instead of relying solely on a static password, 2FA demands a second verification factor: something you know (password) combined with something you have (an authentication code generated by a device or software token).

How the TOTP Algorithm (RFC 6238) Works Under the Hood

The Time-Based One-Time Password algorithm generates deterministic, short-lived security codes based on a shared secret key and the current Unix epoch time:

1. Shared Secret Key (Base32): When setting up 2FA on services like Google, GitHub, or AWS, the server and client exchange a secret key encoded in Base32 (using characters A-Z and 2-7).
2. Time-Step Counter (\(T\)): The current Unix timestamp in seconds (\(CurrentTime\)) is divided by the time-step window (\(X\), conventionally 30 seconds):
   T = floor((CurrentTime - T0) / X)
   Because both your computer and the authentication server share synchronized Unix clocks, both calculate the exact same value for \(T\).
3. HMAC Computation: The time counter \(T\) is serialized as an 8-byte big-endian binary buffer. An HMAC digest (HMAC-SHA-1, HMAC-SHA-256, or HMAC-SHA-512) is computed using the shared secret key and the time counter buffer:
   HMAC = HMAC-SHA1(SecretKey, TimeBuffer)
4. Dynamic Truncation: The last 4 bits of the resulting HMAC hash (the low-order 4 bits of the last byte) are used as an offset index (between 0 and 15). A 4-byte slice is extracted starting at that offset, masking the most significant bit to avoid signed integer issues:
   BinaryCode = ((HMAC[offset] & 0x7F) << 24) | ((HMAC[offset+1] & 0xFF) << 16) | ((HMAC[offset+2] & 0xFF) << 8) | (HMAC[offset+3] & 0xFF)
5. Modulo & Zero Padding: To produce a 6-digit or 8-digit code, the binary code is calculated modulo \(10^d\) (e.g., \(10^6 = 1,000,000\)) and left-padded with zeroes:
   OTC = (BinaryCode % 10^Digits).padStart(Digits, '0')

Why Use This Online 2FA Code Generator?

• Developer Testing & Automation: Test 2FA login workflows, webhooks, and backend verification algorithms without needing to pick up your smartphone.
• Emergency Account Recovery: If your phone is unavailable, broken, or lost, but you have stored your secret seed or otpauth:// setup key in a secure password manager, you can generate your active login code directly in your browser.
• Full Customization: Supports standard 6-digit and 8-digit codes, 30-second and 60-second intervals, as well as modern SHA-256 and SHA-512 algorithms.
• 100% Client-Side Privacy: Uses the browser's native Web Crypto API (window.crypto.subtle). Zero network calls are made.

Frequently Asked Questions (FAQ)