TOTP Generator
Generate Time-based One-Time Passwords (2FA codes) from a secret with QR code for authenticator apps
Interactive tool
Configuration
No TOTP yet
Paste a base32 secret or generate a new one to start
What is a TOTP Generator?
TOTP (Time-based One-Time Password) is the standard behind two-factor authentication codes shown by Google Authenticator, Authy, 1Password, and similar apps. This generator computes a fresh six-to-eight digit code every 30 seconds from a shared secret, and produces a QR code so any authenticator app can enroll in a single scan.
How to Use This TOTP Generator
- 1Generate a random base32 secret or paste an existing one
- 2Enter the issuer (your service name) and account (user identifier)
- 3Choose algorithm, digit count, and period if you need non-default values
- 4Scan the QR code with Google Authenticator, Authy, 1Password, or any RFC 6238 app
- 5Watch the live 30-second code refresh and copy it for testing
Key features
RFC 6238 Compliant
Implements TOTP as specified by IETF RFC 6238: interoperable with every standard authenticator app
Authenticator QR Code
otpauth:// URI rendered as a QR code so any 2FA app can enroll instantly
Live Refresh
Current code, next code, and remaining seconds update in real time
Configurable Algorithm
SHA1 (default), SHA256, or SHA512 hash function
6, 7, or 8 Digit Codes
Choose digit count to match your backend or compliance requirement
Custom Period
15, 30, or 60 second windows for high-security or low-latency cases
Random Secret Generation
Cryptographically random 160-bit base32 secret on demand
100% Private
Secrets and codes never leave your browser. Nothing is uploaded
Why Use a TOTP Generator?
TOTP is the most widely deployed two-factor authentication method outside of SMS. Generating codes locally lets you test integrations during development, debug enrollment flows, audit migrations between authenticator apps, and recover access when an authenticator is unavailable. Unlike copying secrets to a third-party service, this generator runs entirely in your browser so secrets stay on your device.
Common use cases
- Testing 2FA flows in staging or development environments
- Debugging authenticator enrollment for new applications
- Migrating secrets between authenticator apps
- Backup recovery when an authenticator app is unavailable
- Demonstrating TOTP behavior to teammates or students
- Building integration tests that need a live TOTP code
- Generating fresh secrets for security key rotation
- Comparing TOTP behavior across different algorithms or periods
How TOTP Works
TOTP combines HMAC-SHA1 (or SHA256/SHA512) with the current Unix time divided into 30-second windows. The HMAC of the time counter is truncated to a numeric code. Both server and client compute the same code from the same secret and clock, allowing verification without sending the secret over the network for every login.
Compatibility Notes
Google Authenticator only supports SHA1 with 6 digits and a 30-second period. Authy and 1Password support all algorithms. Custom backends often follow RFC 6238 exactly. If a code is not accepted, double-check that the algorithm, digits, and period match the server configuration.
Tips & best practices
Stick with SHA1 for max compatibility
Despite SHA1 being deprecated for general hashing, RFC 6238 still uses HMAC-SHA1 by default and most apps require it
Keep secrets secret
Treat the base32 secret like a password. Never share it via email or chat. Rotate immediately on suspected leak
Sync your clock
TOTP requires accurate time. Drift of more than 30 seconds breaks codes. Enable network time on devices that generate or verify TOTP
Verify with the next code window
Some servers accept the previous, current, and next 30-second code to absorb clock drift. Use the displayed Next code to test
Use 8 digits for higher security
Not all apps support 8-digit TOTP, but it doubles brute-force difficulty when both ends agree
Privacy & security
This TOTP generator runs entirely in your web browser. Your secrets, account names, and generated codes never leave your device, are not stored anywhere, and are not transmitted to any server. The QR code is generated locally as well.
Related tools
- HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, and SHA-512 in hex or base64 output
Encoding Tools
- X.509 Certificate Decoder
Decode PEM and DER X.509 certificates to inspect subject, issuer, validity, fingerprints, and extensions
Encoding Tools
- Unicode Converter
Convert text to and from Unicode escapes, code points, UTF-8 hex bytes, and Unicode normalization forms
Encoding Tools
- Video Compressor
Shrink mp4, webm, and mov videos right in your browser with ffmpeg.wasm. Choose a target preset (web 720p / 1080p, Discord 25 MB, Twitter 512 MB) or set a custom H.264 CRF: your files never leave the device.
Video Tools
- JSON Formatter & Validator
Format, validate, and beautify JSON data instantly in your browser
Developer Tools
- XML Formatter & Validator
Pretty-print, minify, and validate XML with configurable indentation, attribute formatting, and well-formedness checks
Developer Tools
Frequently Asked Questions
What is TOTP and how does it differ from HOTP?
TOTP is Time-based One-Time Password, defined in RFC 6238. It generates a fresh code every period (typically 30 seconds) based on the current time and a shared secret. HOTP, defined in RFC 4226, generates codes based on a counter that increments after each use. TOTP is the standard for modern 2FA apps.
Which authenticator apps work with this generator?
Any RFC 6238 compliant app works, including Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and Yubico Authenticator. Scan the displayed QR code or enter the secret manually with the issuer and account.
Why is my code not accepted by the server?
The most common cause is clock drift between your device and the server. TOTP requires both clocks to agree within the period (usually 30 seconds). Other causes are mismatched algorithm (SHA1 vs SHA256), digit count (6 vs 8), or period. Check that all three match the server configuration.
Is the generated secret cryptographically secure?
Yes. The generator uses a 160-bit (20-byte) random secret produced by the otpauth library, which uses the browser SubtleCrypto API. This matches RFC 6238 recommendations for HMAC-SHA1 secrets.
Can I use this as a primary authenticator app?
No. This is a development and verification tool, not a long-term authenticator. Use a dedicated app like Authy, 1Password, or a hardware key for primary 2FA. Secrets in this tool exist only for the current session and are lost on page reload.
Are my secrets uploaded anywhere?
No. The TOTP generator runs entirely in your browser. Secrets, account names, codes, and the QR code are computed locally. Nothing is sent to any server. The page can be used offline once loaded.