Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
TOTP Code Generator
Live 2FA codes (TOTP, RFC 6238) from a Base32 secret or otpauth link, with SHA-1/256/512, 6 or 8 digits and a QR code for testing.
Time-based one-time passwords (TOTP) are the six-digit codes shown by Google Authenticator, Microsoft Authenticator, Authy and other two-factor authentication apps. They are calculated from a shared secret key and the current time, following the open standard RFC 6238. This TOTP generator calculates the same codes in your browser: paste a Base32 secret or a full otpauth:// link and see the current code, a countdown to the next one, and the next code in advance.
It supports SHA-1 (the default for almost every service), SHA-256 and SHA-512, 6 or 8-digit codes and 30 or 60-second periods. Developers can create a new random secret with a QR code to test their own 2FA setup with a real authenticator app. The secret is never stored, never added to the page address and never sent anywhere.
How to use TOTP Code Generator
- Paste your Base32 secret key or an otpauth://totp/ link.
- Check the settings: algorithm, digits and period (usually SHA-1, 6 digits, 30 seconds).
- Read the current code and the time left before it changes.
- To test your own app, press New random secret and scan the QR code.
Features
- TOTP codes as in RFC 6238, verified against the RFC test vectors.
- Base32 secrets (spaces and lower case accepted) or otpauth:// links.
- SHA-1, SHA-256 and SHA-512; 6 or 8 digits; 30 or 60 seconds.
- Live countdown and the next code.
- New random 160-bit secret with a QR code for authenticator apps.
- Computed with Web Crypto; the secret never leaves the page.
How TOTP works
Your service and your authenticator app share a secret key, usually shown as a QR code or a Base32 string when you turn on two-factor authentication. Every 30 seconds both sides take the number of 30-second steps since 1 January 1970, combine it with the secret using HMAC (a keyed hash), and turn part of the result into a 6-digit number. Because both use the same secret and the same clock, they get the same code without talking to each other — which is why the app works offline.
| Setting | Usual value | Other options |
|---|---|---|
| Algorithm | SHA-1 | SHA-256, SHA-512 |
| Digits | 6 | 8 |
| Period | 30 seconds | 60 seconds |
| Secret length | 160 bits (32 Base32 characters) | At least 80 bits |
otpauth links and QR codes
The QR code you scan when setting up 2FA contains a link like otpauth://totp/Example:you@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example. Paste such a link and the generator reads the secret and any algorithm, digits and period it contains. For testing, New random secret creates a 160-bit secret and its QR code; scan it with your authenticator app and both should show the same code at the same time.
Codes don't match?
Almost always this is the clock: TOTP needs the device time to be correct to within a few seconds, so turn on automatic time on your computer or phone. Also check that the secret was copied completely, and that the algorithm, digits and period match the service — most services use SHA-1, 6 digits and 30 seconds even when they say SHA-256. Many servers also accept the previous and next code to allow for small clock differences.
Using real secrets safely
A TOTP secret is as sensitive as a password: anyone who has it can produce your codes. This page computes everything locally with the browser's Web Crypto API; the secret isn't saved, isn't put in the page address and isn't sent to any server. Still, only enter a real account's secret on a device you trust, close the tab afterwards, and keep your authenticator app and recovery codes as your main way to sign in.
Frequently asked questions
What is a TOTP code?
A time-based one-time password: a short code that changes every 30 seconds, computed from a shared secret and the current time (RFC 6238).
Is this the same as Google Authenticator?
It calculates the same codes as Google Authenticator and other TOTP apps when given the same secret and settings.
Why is my code different from the app?
Check that your device clock is correct, that the full secret was copied, and that the algorithm, digits and period match.
Is my secret sent anywhere?
No. Codes are computed in your browser. The secret isn't stored, logged or added to the URL.
Can I use it for HOTP (counter-based) codes?
No, only time-based TOTP codes are supported.
What format is the secret?
Base32 (letters A–Z and digits 2–7). Spaces, dashes and lower case are accepted.
Can I create a secret for my own app?
Yes. Press New random secret to get a 160-bit secret and a QR code to test with an authenticator app.
Related tools
Password GeneratorGenerate strong random passwords and memorable passphrases. Choose length and characters; see entropy and crack time. Never stored or sent.
API Key GeneratorGenerate secure random API keys, tokens and secrets of 128–512 bits in Base62, hex, Base64, Base64URL or Base32, with an optional prefix.
Password Strength CheckerCheck how strong a password really is: common passwords, words, names, keyboard patterns and dates detected, crack-time estimates and tips.
QR Code GeneratorCreate free QR codes for links, text, Wi-Fi, email, phone, SMS, contacts and locations. Custom colours and logo, PNG or SVG. They never expire.
Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 and CRC32 hashes of text or files of any size, with HMAC and checksum comparison. Private.
PIN GeneratorGenerate secure random PIN codes of 4 to 12 digits that avoid common, repeated, sequential, year and date patterns. Made in your browser.