← All security tools

TOTP authenticator

TOTP

Paste a base32 secret. Codes refresh every 30 seconds. Secrets stay local.

Runs in your browser. Inputs stay on this device — nothing is uploaded to BrowserSpaces for processing.

Generate

Current 6-digit code.

Verify

Check a code you typed.

Countdown

Seconds left in the window.

Use the tool

How it works

How TOTP works

RFC 6238: HMAC-SHA1 over a time counter, truncated to 6 digits. We only use Web Crypto — no cloud authenticator.

Before you start

  • Treat secrets like passwords.
  • Clock skew can cause mismatches.

Three steps

  1. 1

    Paste secret

    Base32 from your issuer.

  2. 2

    Read code

    Use it to sign in.

  3. 3

    Optional verify

    Confirm a code matches.