> totp | authenticator | generator <
Generate time-based (TOTP) and counter-based (HOTP) one-time passwords from a Base32 secret. Test 2FA setups, debug authenticator mismatches and build otpauth:// URIs - all locally in your browser.
Secrets never leave your browser. Still, avoid pasting live production secrets on shared computers.
OTPAUTH URI
Need a QR code for an authenticator app? Paste the URI into the QR Code Generator
Live Codes with Countdown
Paste a Base32 secret and get the current and next code, refreshed every period, with a progress bar showing when it expires.
SHA-1, SHA-256, SHA-512
Choose 6, 7 or 8 digits and any period. HMAC runs through the Web Crypto API and matches the RFC 4226 and RFC 6238 test vectors.
otpauth URI Builder & Importer
Build otpauth:// URIs for authenticator apps or import an existing one to fill every field automatically. Nothing is uploaded.
>> technical info
How One-Time Passwords Work:
HOTP (RFC 4226) computes HMAC(secret, counter) and truncates the result to 6-8 digits. TOTP (RFC 6238) is HOTP where the counter is the Unix time divided by the period (usually 30 seconds), so the code changes every period and both sides agree without talking to each other. The shared secret is normally exchanged as Base32 text or a QR code containing an otpauth:// URI.
Example:
RFC 6238 test vector (SHA-1) secret = GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ time = 59 -> counter = 59 / 30 = 1 code (8 digits) = 94287082
Why Use This TOTP Generator:
- >Test and debug two-factor authentication while developing a login flow
- >Find out why an authenticator app and a server disagree on the code
- >Create otpauth:// URIs with the right issuer, algorithm, digits and period
- >Check codes against fixed timestamps using the Unix time override
>> frequently asked questions
Q: How does TOTP work?
A: Your app and the server share a secret. Both compute HMAC of the secret and the current time step (Unix time divided by the period, 30 seconds by default), then truncate it to a 6-digit code. If both clocks agree, both get the same code.
Q: Is it safe to enter my secret here?
A: The calculation happens entirely in your browser with the Web Crypto API and nothing is sent to a server. Still, a TOTP secret is the key to your account: do not paste real production secrets on shared or untrusted computers, and prefer test accounts for debugging.
Q: Why does my code not match my authenticator app?
A: The most common causes are a wrong clock (TOTP needs time accurate to a few seconds), a different algorithm, digit count or period, or a secret copied with a typo. Check that SHA-1, 6 digits and 30 seconds are selected, which is what almost every service uses.
Q: What is the difference between TOTP and HOTP?
A: HOTP uses an incrementing counter that advances only when a code is used, so a code stays valid until it is consumed. TOTP derives the counter from the clock, so codes expire automatically every period. TOTP is far more common for consumer 2FA.
Q: What is an otpauth:// URI?
A: It is the text inside the QR code you scan when enabling 2FA, such as otpauth://totp/Example:user@example.com?secret=...&issuer=Example. It carries the secret, issuer, account and optional algorithm, digits and period. Paste it into the import box to extract the secret.
Q: Which settings do authenticator apps support?
A: Google Authenticator and many other apps ignore the algorithm, digits and period parameters and always use SHA-1, 6 digits and 30 seconds. Use those defaults unless you know your app and server both support something else.
What happens at the largest HOTP counter?
Counters use exact unsigned 64-bit integers from 0 to 18446744073709551615. At the maximum, the next code and increment button are disabled; the counter never wraps. HOTP imports require one explicit decimal counter, without fractions, exponent notation or duplicate parameters.