loot.toolsA TOTP code is an HMAC of the current time window and your shared secret, truncated down to six or eight digits. Both your authenticator app and the server run the same math, so they land on the same number without ever talking to each other. Every 30 seconds the time window ticks over and a fresh code appears.
Most services use 6 digits, a 30-second period, and SHA1, which are the defaults here. Some use 8 digits, a 60-second window, or SHA256/SHA512. If the code doesn't line up with what your app expects, check those three settings against the provider's documentation or the otpauth URL from the QR code.
Testing a login flow without reaching for your phone. Debugging a 2FA integration during development. Keeping a backup way to generate codes for an account you control. Paste the base32 secret, watch the code and its countdown, and copy it before the window resets. Nothing about the secret or the codes leaves your browser.