TOTP Generator
Turn a base32 secret into a live TOTP two-factor code in your browser, with a scannable QR code, otpauth:// import and a code verifier.
TOTP Generator — Paste a base32 secret — or a whole otpauth:// setup URI — and watch the matching TOTP two-factor code update every second, exactly like Google Authenticator or Authy. Pick SHA-1, SHA-256 or SHA-512, 6 or 8 digits and a custom period, add issuer and account labels, scan the generated QR code into your app, and verify a typed code against a one-step window. Everything is computed locally with the Web Crypto API, so your secret never leaves your browser.
What is TOTP Generator?
The TOTP Generator is a free online tool that turns a base32 shared secret into the same time-based one-time password (TOTP) that apps like Google Authenticator, Authy or Microsoft Authenticator produce, and it can round-trip a full otpauth:// setup URI. Developers and QA engineers use it to test two-factor flows, register a test account by scanning its QR code, or confirm that a typed code is valid. It implements RFC 6238 over RFC 4226 HOTP, computing an HMAC with your chosen SHA-1, SHA-256 or SHA-512 hash and applying dynamic truncation to a 6- or 8-digit code that rolls over every period. Paste an otpauth:// URI to auto-fill the secret, issuer, account, algorithm, digits and period; the live code, the countdown, the scannable QR code and a plus/minus one-step code verifier all update on their own.
How to use TOTP Generator
- Paste a base32 secret into the Secret field, click Generate secret for a fresh random one, or paste an otpauth:// URI and hit Fill from URI to auto-fill every field.
- Open the settings to pick the hash algorithm (SHA-1, SHA-256 or SHA-512), 6 or 8 digits, and the period in seconds — the code is recomputed with exactly those choices.
- Add an issuer and account label so the generated otpauth:// URI and QR code identify the account.
- Read the current code from the Code field and copy it, or scan the QR code into your authenticator app to register the account.
- Type a code into Verify a code to check it against the current code and one step before or after.
Examples
Add a test account by QR code
Enter a secret, set an issuer like Example Corp and an account like alice@example.com, then scan the generated QR code with Google Authenticator or Authy. Because the QR encodes the same secret, algorithm, digits and period, both sides then produce identical codes.
Import an existing otpauth:// URI
Paste a string such as otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA256&digits=8&period=30 and click Fill from URI; the secret, issuer, account, SHA-256 algorithm, 8 digits and 30-second period fill in automatically and the live code appears.
Verify a code with the step window
Paste the code your app is showing into Verify a code. It is marked valid whether it matches the current 30-second step or the one immediately before or after, which covers small clock drift between devices.
Frequently asked questions
- Is my secret uploaded anywhere?
- No. The base32 secret, the otpauth:// URI and the QR code all stay in your browser. Codes are computed locally with the Web Crypto API and the QR is drawn on-device, so nothing is sent to or stored on any server and the tool works offline.
- Which algorithms are supported?
- SHA-1, SHA-256 and SHA-512. The selected algorithm is used for the actual HMAC, so the code matches a service configured for any of them. SHA-1 is the default that virtually all authenticator apps use.
- How do I add the account to my authenticator app?
- Fill in the secret plus an issuer and account, then scan the generated QR code — which encodes an otpauth://totp URI — with Google Authenticator, Authy or a similar app, or download the QR as a PNG. You can also copy the otpauth:// URI directly.
- What does the code verifier check?
- It compares the code you type against the current period's code and the codes one step before and after (a plus/minus one window), so a code that just expired or is a moment early still validates. This mirrors the small tolerance most servers allow for clock drift.
- Why doesn't my code match my authenticator app?
- TOTP depends on the current time and the exact secret, algorithm, digit length and period. Check that the algorithm (SHA-1/256/512), digits (6 or 8) and period (usually 30 seconds) match your service, that you pasted the full secret, and that your device clock is accurate.
Related tools
AES Text Encryption (AES-GCM + PBKDF2)
Encrypt and decrypt text with AES-256-GCM using a passphrase-derived key (PBKDF2 SHA-256, random salt), entirely in your browser with no uploads.
Argon2 & scrypt Hash
Hash a password with Argon2id or scrypt and verify an Argon2 hash against a password, entirely in your browser.
Bcrypt Hash Generator & Verifier
Generate a bcrypt password hash from plain text at a chosen cost factor, or verify a password against an existing bcrypt hash, entirely in your browser.
BIP39 Mnemonic Generator
Generate a random BIP39 recovery phrase of 12 to 24 words in several languages, or convert an existing mnemonic back into its raw entropy, entirely in your browser.