TOTP Generator
Two-factor codes from a base32 secret, computed in your browser. Nothing is sent or stored.
Enter a base32 secret to generate a code
Spaces, dashes and padding are ignored. Letters A–Z and digits 2–7 only.
Almost every service uses SHA-1, 6 digits and 30 seconds — the defaults here.
otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30
How to Use
- 1. Paste your base32 secret key.
- 2. Set the algorithm, digit count and period if the service uses non-standard values.
- 3. Read the current code and the countdown to the next one.
- 4. Copy the otpauth URI if you need to set up an authenticator app.
How TOTP Works
The clever part of two-factor codes is that nothing is ever transmitted. When you scan a setup QR code, your device and the server both store the same shared secret. To produce a code, each side takes the current Unix time, divides it by 30 to get a counter, and computes an HMAC of that counter using the secret. Six digits are then extracted from the result. Both sides do this independently and arrive at the same answer — there is no network call, which is why authenticator apps work in aeroplane mode.
Because the counter is derived from the clock, TOTP is only as good as your device's time. A phone a minute out of sync produces codes the server rejects, which is the single most common cause of "invalid code" errors. Servers usually accept one window either side of the current one to absorb small drift, which is why the previous and next codes are shown here too.
SHA-1 is the default because that is what services actually use. It is broken for collision resistance, which matters for certificates and signatures, but HMAC-SHA1 remains sound for this purpose — change the algorithm only if a service explicitly tells you to.
A practical note on trust: the secret you paste here stays in your browser and nothing is stored. Even so, for a secret protecting a live account, the sensible habit is to use a tool like this for setup and debugging rather than as your day-to-day authenticator.
Related: QR Code Generator, HMAC Generator, and Password Generator.
Frequently Asked Questions
What is TOTP?
Time-based One-Time Password, the standard behind Google Authenticator, Authy and most two-factor apps. A shared secret is combined with the current 30-second time window and hashed, so both your device and the server derive the same six digits without ever exchanging them.
Is it safe to paste my real 2FA secret here?
The secret never leaves your browser — the code is computed locally and nothing is stored or transmitted. That said, for a secret protecting a real account, the safer habit is to use this for testing and setup verification rather than as your everyday authenticator.
Why does my code not match my authenticator app?
Almost always a clock problem or a parameter mismatch. TOTP depends on your device clock being accurate to within a few seconds, and the algorithm, digit count and period all have to match what the server expects. Most services use SHA-1, 6 digits and 30 seconds — the defaults here.
Why is SHA-1 the default when it is considered broken?
Because that is what virtually every service actually uses. SHA-1 is broken for collision resistance, which matters for certificates and signatures, but HMAC-SHA1 remains secure for this purpose. Change it only if a service explicitly tells you to.
What is the otpauth URI for?
It is the string encoded inside a 2FA setup QR code. Generate the URI here, turn it into a QR code, and any authenticator app can scan it — useful when a service gives you a secret but no QR code.
Was this tool helpful?
More Tools
Related Security
File Checksum Verifier
Barcode Generator
QR Code Scanner
Bcrypt Generator & Verifier
You Might Also Like