Fryguy's Blog Back to Tools
TOTPRFC 6238
Generate the current time-based one-time password for a Base32 MFA secret — the same algorithm Google Authenticator, Authy, and every RFC 6238-compliant app use. Handy for testing MFA integrations without reaching for your phone.
Your secret is decoded and hashed entirely in your browser (Web Crypto API) — it's never sent anywhere. Still, avoid pasting real production secrets into any web page you don't control.
Example: