TOTP 2FA Codes Explained — How They Work and Why Offline Matters

laofudev — Fri, 30 Oct 2026 04:20:51 +0000

Two-factor authentication is the default answer to "what if my password leaks?" The six-digit codes that rotate every thirty seconds look simple, but the algorithm behind them is one of the most widely deployed pieces of cryptography on the internet. Understanding how TOTP works takes five minutes and tells you exactly what to protect — and what you can safely compute offline.

Also published on the Minitool blog.

What TOTP Actually Is

TOTP is Time-based One-Time Password, defined in RFC 6238. It extends the older HMAC-based OTP (RFC 4226) by adding a clock. The idea: your authenticator and the service you're logging into share a secret key. To produce a code, both combine that secret with the current time chopped into 30-second windows, and run HMAC-SHA1 over it. If the two clocks roughly agree, they derive the same six digits.

No network connection is needed to generate a code. Your phone, a hardware key, or a web page all compute the same math independently. The code proves possession of the secret, not connectivity.

The Trust Problem Nobody Talks About

Here is the catch with most online "2FA code generators": to produce your code, the site needs your secret key. Typing a TOTP secret into a random web tool means that server — or anything compromised along the path — can now generate your codes forever. Fine for a throwaway test account. Never for email or banking.

This is why an offline generator matters. The TOTP Generator runs the standard RFC 6238 algorithm entirely in the browser with plain JavaScript. The secret is combined with the time window locally, the HMAC is computed locally, the code is rendered locally. View source and audit the whole thing. Your secret never leaves the device, which makes it suitable for staging accounts, API sandboxes, shared demo logins, and all the automation test users that don't deserve a slot in your phone's authenticator.

The Workflow

Copy the TOTP secret (the Base32 string from the QR setup screen) for the disposable account.
Open the TOTP Generator and paste it in.
Read the current six-digit code and its countdown, enter it in the service, done.

Because the implementation follows the RFC exactly, the codes match what Google Authenticator or any other standard app produces for the same secret and time.

Getting the Rest of Authentication in Order

A second factor only helps if the first factor isn't trivially guessable. If you're auditing your own habits, run your current passwords through the Password Strength Checker — it estimates crack time offline. For anything new, use the Password Generator and store the result in a reputable password manager.

The Takeaway

TOTP is elegant precisely because it is self-contained: a shared secret plus a clock produces a proof of possession with no round trips. That same self-containment is your best privacy guarantee — but only if the generator you use keeps the secret local. Run it in the browser, audit the source, and reserve your phone's authenticator for the accounts that truly matter.

Minitool runs entirely in your browser — no signup, no uploads, no tracking. 540+ free tools at minitool.io.

I Ship 10 Free Browser Tools a Day. Here Are 12 I Actually Use.

laofudev — Fri, 30 Oct 2026 03:15:51 +0000

Eight weeks ago I started a strange routine: every day, ship 10 new free tools to a single website. No signup walls, no ads, no server-side anything. Just HTML, CSS, and JavaScript that runs entirely in the browser.

Today the catalog passed 546 tools. The pace is one batch per day, every day, and I have no plans to stop.

Before the catalog drowns in its own size, I want to point at the ones I actually open — the tools that survived daily use instead of just shipping.

The rules everything follows

Every tool on the site obeys the same constraints, which turned out to be a feature rather than a limitation:

Zero backend. Your data never leaves your device. There's no server to breach, no analytics on your input.
Instant load. No frameworks, no build step. The heaviest tool on the site is 170 KB.
Works offline once the page loads.
No dark patterns. No cookie banners, no "premium" tier, no newsletter modal.

The 12 I keep using

TOTP Generator — Time-based 2FA codes in the browser, standard RFC 6238. I use it for test accounts where I don't want to touch my phone. Same math as Google Authenticator, entirely client-side.

Hex Viewer — Drag any file in, get offsets, hex bytes, and the ASCII column, plus a per-byte inspector. 256 KB cap, which is exactly enough for "what is this header, actually."

JWT Signature Verifier — Paste a token, verify HS/RS/ES signatures offline with Web Crypto, and check exp/nbf/iat claims. Debugging auth without sending tokens to a random website is the whole point.

JSON to Kotlin — Paste a JSON response, get data classes with inferred types, nullables, and deduplicated nested classes. Saves me maybe ten minutes per API integration, which adds up.

Markdown Table to CSV — Because documentation tables should not require a text editor macro. Handles escaped pipes and alignment row stripping.

CSS Grid Generator — Edit a grid template visually, watch the live preview, copy the CSS and HTML. I stopped hand-counting grid-template-columns fractions.

Tap Tempo — Tap any key to get BPM with median outlier filtering. Niche? Extremely. The one time you need it, nothing else works.

Wordle Solver — Filter a 6,012-word list by green/yellow/gray feedback. Yes, it handles double letters correctly — that was a whole afternoon.

Enigma Simulator — A working German Enigma I in JavaScript: rotors I–V, reflectors, plugboard. The classic test vector AAAAA → BDZGO passes. Educational and weirdly fun to break codes with.

Running Pace Calculator — Pace, speed, and Riegel-based race predictions. It told me my 10K goal was unrealistic. It was right.

Ratio Calculator — The "solve for the missing value" proportions calculator. Aspect ratios, recipe scaling, mixing, whatever.

DCA Calculator — Dollar-cost averaging projection versus lump sum, weekly/monthly/yearly. The comparison chart is the honest part most investing sites skip.

How the factory works

People keep asking whether the tools are generated by AI. Here's the honest answer: yes, mostly — but not in the fire-and-forget way.

Each batch goes through a fixed pipeline:

Dedup check against the live catalog (plus a fresh crawl of the site) — no slug collisions, ever.
Known-answer tests. Every tool ships with test vectors checked against independent reference implementations. The Enigma simulator was validated against published vectors. The crypto tools cross-checked against node:crypto. The finance tools against plain Python.
A validator that checks packaging, metadata lengths, zero external dependencies, and no outbound links.
A headless-Chrome smoke test that loads each tool, clicks the sample button, and fails on any console error.

This catches real bugs constantly — just this week: a JSONPath tokenizer choking on bare < operators, a Sudoku solver that would hang forever on contradictory grids, and a CSV deduplicator that mangled RFC 4180 quoting. Shipping fast and shipping correct are not the same thing; the gates are what let me do both.

Why browser-only matters more than it sounds

The web got weird about privacy. Half the "free tools" you find upload your input to a server "for processing" — your JSON, your JWT, your file contents. For a lot of tasks there's no reason. JavaScript is fast enough for regex testing, AES-256-GCM, Boggle solving, all of it.

Every tool on the site is also trivially inspectable: view source is the whole program. If you don't trust the tool, you can read exactly what it does with your data, which is: nothing.

The catalog

If any of the above sounded useful, the full list is at minitool.io — 546 tools across text, developer utilities, and calculators, with 10 more landing every day.

And if there's a tool you keep needing that doesn't exist yet: tell me. Odds are it ships tomorrow morning.

DEV Community: laofudev