TOTP Code Generator
Generate the current TOTP two-factor code (RFC 6238) from a base32 secret — the same codes authenticator apps produce. Supports 6/8 digits, 30/60-second steps and SHA-1/256/512. Deterministic HMAC via Web Crypto; nothing is stored.
Worked examples
Classic test secret (SHA-1, 6 digits)
GET /api/v1/security/totp-generator?secret=JBSWY3DPEHPK3PXP
Result: 251041
8 digits, SHA-256
GET /api/v1/security/totp-generator?secret=JBSWY3DPEHPK3PXP&algo=SHA256&digits=8
Result: 73400158
Google Authenticator default
GET /api/v1/security/totp-generator?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
Result: 928012
Machine API (x402)
$0.003 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/totp-generator?secret=JBSWY3DPEHPK3PXP HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/totp-generator",
"input": {"secret":"JBSWY3DPEHPK3PXP"},
"result": { "value": 251041, "answer": "251041" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Generates the exact TOTP code an authenticator app would show right now for a given base32 secret. Implemented per RFC 6238 with Web Crypto HMAC — useful for provisioning 2FA flows, testing integrations, or verifying that a secret was copied correctly. Codes depend on server time and expire with the step.
code = truncate(HMAC-hash(K, floor(unix_time / step))) mod 10^digits
Frequently asked questions
Is my secret safe?
The secret is used in memory for one HMAC computation and never logged or stored. Still, treat production 2FA secrets as credentials — use test secrets for automation.
Why does the code change?
TOTP divides Unix time into steps (30 s by default) and signs the step number. The same secret and step always produce the same code — that's how your phone and the server stay in sync.