Fryguy's Blog Back to Tools
TOTPRFC 6238
Generate the current time-based one-time password for a Base32 MFA secret — the same algorithm Google Authenticator, Authy, and every RFC 6238-compliant app use. Handy for testing MFA integrations without reaching for your phone.
Your secret is decoded and hashed entirely in your browser (Web Crypto API) — it's never sent anywhere. Still, avoid pasting real production secrets into any web page you don't control.
Example:
Provided as-is, with no warranty of any kind. Your Base32 secret is processed entirely in your browser and never transmitted or stored, but treat it like any other credential — don’t paste secrets for accounts you don’t control into a tool you haven’t audited yourself. See the full disclaimer.