Generate secure TOTP codes for two-factor authentication. Compatible with Google Authenticator, Microsoft Authenticator, and other 2FA apps.
Two-Factor Authentication (2FA) adds an extra layer of security to your accounts by requiring a time-based one-time password (TOTP) in addition to your regular password.
Quick answers for people using this online TOTP generator with Base32 secrets, otpauth URLs, QR code images, and authenticator apps.
Yes. This tool generates standard TOTP codes that work with Google Authenticator-style 2FA setups. Paste the Base32 secret, an otpauth:// URL, or import the QR code image to generate the same time-based code in your browser.
Yes. Enter the Base32 secret key shown during 2FA setup, including keys with spaces or lowercase letters. The generator normalizes the secret and creates a 6-digit or 8-digit authentication code based on the TOTP settings.
An otpauth:// URL stores the same information found in many 2FA QR codes: the secret, issuer, account name, digit length, algorithm, and refresh period. When you paste one here, the page parses those settings automatically.
Yes. Upload a QR code image or paste a QR screenshot directly on the page. The QR decoder runs in your browser and extracts the otpauth URL locally, so your 2FA secret is not sent to a server.
No. The 2FA secret, otpauth URL, and QR image are processed locally in your browser. BaseToolbox does not store the secret, sync it, or send it to an API.
Most TOTP codes follow RFC 6238 and use a 30-second time window. The code is calculated from your shared secret and the current time, then refreshes when the next period starts.
Yes for standard TOTP accounts. If the service gives you a Base32 secret or an otpauth:// QR code, the generated code should match common authenticator apps such as Microsoft Authenticator, Authy, 1Password, Bitwarden, and Google Authenticator.
Check that you copied the full Base32 secret or the complete otpauth:// URL. Some setup screens hide the manual key behind a link such as "can't scan the QR code". If the QR code belongs to a proprietary push-login flow instead of TOTP, it may not contain a usable secret.