TOTP Code Generator: Frequently Asked Questions

Yes — if you know your account's TOTP secret key (the Base32 string shown during setup), the tool generates the same codes as your authenticator app. However, treat your real secret keys with care — anyone with the secret key can generate valid codes.

The secret key is shown during 2FA setup, either as a QR code or as a text string labelled 'secret key', 'manual entry code', or similar. Most authenticator apps do not let you export secrets after setup. If you did not save it, you will need to disable and re-enable 2FA to get a new secret.

TOTP divides time into 30-second windows and generates a different code for each window. This limits the usefulness of intercepted codes — a code is only valid for at most 30 seconds (plus tolerance). After 30 seconds, the intercepted code is worthless.

TOTP (Time-based) generates codes from the current time. HOTP (HMAC-based, RFC 4226) generates codes from an incrementing counter. TOTP is more common for user-facing 2FA because it does not require synchronising a counter. HOTP is used in hardware tokens and some physical keyfobs.

Most commonly: the code has expired (wait for the next 30-second window), your device's clock is out of sync (check system time), or you are using the wrong secret key. Some sites have very strict clock tolerances and do not accept codes from adjacent windows.

Yes. TOTP is significantly more secure than SMS 2FA, which is vulnerable to SIM-swapping attacks (an attacker convinces your carrier to port your number to their SIM) and SS7 interception attacks. For high-security accounts, use TOTP as a minimum and hardware security keys (FIDO2) for the highest assurance.

TOTP uses HMAC-SHA1 by default (per RFC 6238), though HMAC-SHA256 and HMAC-SHA512 variants are defined. In practice, nearly all implementations use HMAC-SHA1. The tool uses HMAC-SHA1 via the browser's Web Crypto API for cryptographic correctness.