Two-factor authentication is the default answer to "what if my password leaks?" The six-digit codes that rotate every thirty seconds look simple, but the algorithm behind them is one of the most widely deployed pieces of cryptography on the internet. Understanding how TOTP works takes five minutes and tells you exactly what to protect — and what you can safely compute offline.
Also published on the Minitool blog.
What TOTP Actually Is
TOTP is Time-based One-Time Password, defined in RFC 6238. It extends the older HMAC-based OTP (RFC 4226) by adding a clock. The idea: your authenticator and the service you're logging into share a secret key. To produce a code, both combine that secret with the current time chopped into 30-second windows, and run HMAC-SHA1 over it. If the two clocks roughly agree, they derive the same six digits.
No network connection is needed to generate a code. Your phone, a hardware key, or a web page all compute the same math independently. The code proves possession of the secret, not connectivity.
The Trust Problem Nobody Talks About
Here is the catch with most online "2FA code generators": to produce your code, the site needs your secret key. Typing a TOTP secret into a random web tool means that server — or anything compromised along the path — can now generate your codes forever. Fine for a throwaway test account. Never for email or banking.
This is why an offline generator matters. The TOTP Generator runs the standard RFC 6238 algorithm entirely in the browser with plain JavaScript. The secret is combined with the time window locally, the HMAC is computed locally, the code is rendered locally. View source and audit the whole thing. Your secret never leaves the device, which makes it suitable for staging accounts, API sandboxes, shared demo logins, and all the automation test users that don't deserve a slot in your phone's authenticator.
The Workflow
- Copy the TOTP secret (the Base32 string from the QR setup screen) for the disposable account.
- Open the TOTP Generator and paste it in.
- Read the current six-digit code and its countdown, enter it in the service, done.
Because the implementation follows the RFC exactly, the codes match what Google Authenticator or any other standard app produces for the same secret and time.
Getting the Rest of Authentication in Order
A second factor only helps if the first factor isn't trivially guessable. If you're auditing your own habits, run your current passwords through the Password Strength Checker — it estimates crack time offline. For anything new, use the Password Generator and store the result in a reputable password manager.
The Takeaway
TOTP is elegant precisely because it is self-contained: a shared secret plus a clock produces a proof of possession with no round trips. That same self-containment is your best privacy guarantee — but only if the generator you use keeps the secret local. Run it in the browser, audit the source, and reserve your phone's authenticator for the accounts that truly matter.
Minitool runs entirely in your browser — no signup, no uploads, no tracking. 540+ free tools at minitool.io.
Top comments (0)