SECURITY BENCH

TOTP code generator (RFC 6238)

Compute a 6-digit time-based one-time password (TOTP) from a Base32 secret and current time, using HMAC-SHA-1. Useful for test fixtures and recovering a code when your authenticator is unavailable.

LOCAL RUNRuns entirely in your browser.Security tools

Saved tools and recents stay in this browser. Turn on sync on your account page to carry them to another device.

WHAT THIS DOES

Generate a 6-digit RFC 6238 TOTP code locally for testing and recovery.

Runs entirely in your browser.

Technical details

Workbench: /tools/totp-code-generator
Record id: totp-code
Version: v4.0.0
Processing mode: LOCAL · LOCAL RUN
Publication status: IMPLEMENTED — This workbench is functional in the current release.
Interface size: 1 input · 2 outputs

BATCH / ONE VALUE PER LINE

Run this workbench down a column

Up to 200 lines, one at a time, in this browser. Each line takes the place of secret and everything else stays as you set it. Nothing is uploaded, and the row limit is not exceeded silently.

Values, one per line

1 line · 0 characters

0 values ready

METHOD / LOCAL RUN

How this tool works

The current Unix time is divided into 30-second steps. HMAC-SHA-1 of the step against the Base32-decoded secret is truncated to 6 digits.

Boundary: TOTP codes are sensitive secrets. Do not paste real production TOTP secrets. This is a local utility, not an authenticator app replacement.

The calculation or transformation runs in your browser using the values entered above. No input is sent to UtilityForge for this tool.

EXAMPLES / LOCAL RUN FIXTURES

Try a known input

FAQ

Questions about this tool

Is this tool a substitute for a credential vault?

No. UtilityForge is a local workbench. Use a real password manager and authentication system for credentials.

Does my input leave this browser?

No. The TOTP code generator runs locally; nothing is sent to UtilityForge.

How is the result computed?

The workbench states the exact method behind every result — the formula or procedure this page runs — so you can verify the computation instead of trusting a black box.

Does my input leave this device?

No. This workbench runs in the page: Base32 secret are read by the code your browser already downloaded, and UtilityForge receives neither the values nor the result.

Is there a size limit on what I can enter?

Yes, and it is enforced rather than advertised: Base32 secret (100,000 characters). The limit is a browser input limit on a tool that runs on this device, so nothing is truncated after being sent anywhere.

What does the totp code generator (rfc 6238) not do?

TOTP codes are sensitive secrets. Do not paste real production TOTP secrets. This is a local utility, not an authenticator app replacement.

RELATED TOOLS

Continue with a connected job

Processing declaration

LOCAL — Runs entirely in your browser.

COMMON USE CASES / SOURCE NOTE

When this tool is useful

Generate a TOTP test fixture locally.
Recover a code for a known test secret.
Do not use as a replacement for a real authenticator app.

Last reviewed: 2026-08-31

Source information: Local HMAC-SHA-1 over the Base32-decoded secret using the current Unix time; no secret leaves the browser.

PUBLISHING RECORDComplete publishing record

1 input · 2 outputs · 1 worked example · 6 FAQs · 4 related workbenchs