SECURITY BENCH
Compute a 6-digit time-based one-time password (TOTP) from a Base32 secret and current time, using HMAC-SHA-1. Useful for test fixtures and recovering a code when your authenticator is unavailable.
WHAT THIS DOES
Runs entirely in your browser.
/tools/totp-code-generatortotp-codev4.0.0LOCAL · LOCAL RUNIMPLEMENTED — This workbench is functional in the current release.BATCH / ONE VALUE PER LINE
Up to 200 lines, one at a time, in this browser. Each line takes the place of secret and everything else stays as you set it. Nothing is uploaded, and the row limit is not exceeded silently.
METHOD / LOCAL RUN
The current Unix time is divided into 30-second steps. HMAC-SHA-1 of the step against the Base32-decoded secret is truncated to 6 digits.
Boundary: TOTP codes are sensitive secrets. Do not paste real production TOTP secrets. This is a local utility, not an authenticator app replacement.
The calculation or transformation runs in your browser using the values entered above. No input is sent to UtilityForge for this tool.
EXAMPLES / LOCAL RUN FIXTURES
FAQ
No. UtilityForge is a local workbench. Use a real password manager and authentication system for credentials.
No. The TOTP code generator runs locally; nothing is sent to UtilityForge.
The workbench states the exact method behind every result — the formula or procedure this page runs — so you can verify the computation instead of trusting a black box.
No. This workbench runs in the page: Base32 secret are read by the code your browser already downloaded, and UtilityForge receives neither the values nor the result.
Yes, and it is enforced rather than advertised: Base32 secret (100,000 characters). The limit is a browser input limit on a tool that runs on this device, so nothing is truncated after being sent anywhere.
TOTP codes are sensitive secrets. Do not paste real production TOTP secrets. This is a local utility, not an authenticator app replacement.
RELATED TOOLS
LOCAL — Runs entirely in your browser.
COMMON USE CASES / SOURCE NOTE
Last reviewed:
Source information: Local HMAC-SHA-1 over the Base32-decoded secret using the current Unix time; no secret leaves the browser.