Home › Developer Tools › TOTP Generator

TOTP Generator

Enter a Base32 secret key to see the current two-factor authentication code with a live countdown, or generate a new secret and an otpauth QR code for your app or server. Codes are computed with the RFC 6238 algorithm entirely in your browser.

Secret key (Base32) or otpauth:// link

Algorithm

Digits

Period (s)

Issuer (service name)

Account

Verify a code

Current codeSHA-1 · 6 digits · 30 s

------

30 seconds left

Previous: ------
Next: ------

otpauth URI

How to use the TOTP Generator

Paste your secret key (the Base32 text shown under the QR code when you set up 2FA) or a full otpauth:// link. Spaces and lowercase letters are fine.
Match the settings to the service: almost all use SHA-1, 6 digits and 30 seconds.
Read the code before the ring runs out, or press Copy code.
To set up 2FA for your own app, press Generate secret, enter the issuer and account name, and scan the QR code with an authenticator app.
Check a code by typing it into Verify a code; the tool accepts the previous and next time step to allow for clock drift.

How a TOTP code is calculated

TOTP (RFC 6238) is HOTP (RFC 4226) with the current time as the counter:

Counter: T = floor((Unix time − T0) / period), with T0 = 0 and period = 30 seconds by default.
HMAC: compute HMAC-SHA1 (or SHA-256 / SHA-512) of T, written as an 8-byte big-endian number, using the decoded secret key.
Dynamic truncation: take the low 4 bits of the last byte as an offset, read 4 bytes from that offset and clear the top bit to get a 31-bit number.
Code: that number mod 10^digits, padded with leading zeros (for example 1,234,567,890 mod 10⁶ = 567890).

Because only the time and the shared secret are needed, codes work offline and expire automatically. You can confirm your implementation with the RFC 6238 test vectors: with the ASCII secret 12345678901234567890 (Base32 GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ), SHA-1, 8 digits and Unix time 59, the code is 94287082; at time 1111111109 it is 07081804.

The otpauth:// key URI format

Authenticator apps import accounts from a QR code that contains a URI like this:

otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30

Part	Meaning	Default
`totp`	Type: time-based (`hotp` is counter-based)	required
Label	`Issuer:account`, shown in the app; URL-encoded	required
`secret`	Shared key in Base32, without padding	required
`issuer`	Service name; should match the label prefix	recommended
`algorithm`	SHA1, SHA256 or SHA512	SHA1
`digits`	Code length, 6 or 8 (some apps accept 7)	6
`period`	Seconds per code	30

Tips for developers adding 2FA

Generate a fresh random secret per user (at least 160 bits) and store it encrypted on the server.
Accept the previous and next time step (±30 seconds) to tolerate clock drift, but remember which counter was last used and reject a code that is used twice.
Rate-limit attempts: a 6-digit code has only one million possibilities.
Offer recovery codes when users enable 2FA, in case they lose their phone.

Frequently asked questions

What is a TOTP code?

A Time-based One-Time Password (RFC 6238) is a short code that changes every 30 seconds. It is computed as HMAC(secret, floor(Unix time / 30)), then truncated to 6 digits as described in RFC 4226. Your phone and the server share the same secret, so both calculate the same code without any network connection.

Why is my code different from my authenticator app?

Check three things: the secret must be exactly the same Base32 key, the settings (algorithm, digits, period) must match, and the clocks must agree. TOTP depends on the time, so a computer or phone clock that is off by more than about 30 seconds gives a different code. Turn on automatic time synchronisation.

Is it safe to enter my 2FA secret here?

The code is calculated locally with the browser's WebCrypto API. The secret is not uploaded, logged or saved. Still, anyone who has your secret can generate your codes, so treat it like a password and only use this tool on a device you trust. For daily logins, use an authenticator app.

How long should a TOTP secret be?

RFC 4226 requires at least 128 bits and recommends 160 bits, which is 32 Base32 characters. The Generate secret button creates 160 random bits with crypto.getRandomValues. Shorter secrets such as 16 characters (80 bits) still work in most apps but are weaker.

Which apps can scan the QR code?

Any app that supports the otpauth:// key URI format, including Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, FreeOTP and Aegis. Some apps ignore non-default settings, so SHA-1, 6 digits and 30 seconds are the most compatible choice.

What does the counter value mean?

The counter T is the number of whole periods since 1 January 1970 UTC, floor(Unix time / period). It is the message that is signed with HMAC. Developers can compare it with their own implementation when debugging.

Can I use this for HOTP (counter-based) codes?

This tool generates time-based codes. HOTP uses the same HMAC and truncation but with a counter that increases on every login instead of the clock, so otpauth://hotp links are not supported here.

Related tools