TOTP Generator — 2FA Code Generator and otpauth QR Builder
Turn a Base32 secret into live 2FA codes with a countdown, build an otpauth:// QR code for authenticator apps, or read an existing URI.
Codes depend on your device clock. If they are rejected, check the clock is set automatically; most servers also accept the previous and next code.
otpauth:// URI and QR code
otpauth://totp/Example%20Inc:jane%40example.com?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ&issuer=Example%20Inc&algorithm=SHA1&digits=6&period=30
Scan with Google Authenticator, Microsoft Authenticator, 1Password, Authy or any TOTP app. Many apps ignore SHA-256/512 and 8 digits; keep the defaults unless you control both sides.
Read an otpauth:// URI
Secrets and codes stay in your browser. Nothing is sent or stored. Treat a TOTP secret like a password: anyone who has it can generate your codes. Browse all free tools.
Found a problem, or something that could be better? We read every message and we fix things quickly.
This TOTP generator produces the same time-based one-time codes as Google Authenticator, Microsoft Authenticator, 1Password and other authenticator apps. Enter a Base32 secret and the current 6 or 8-digit code appears with a countdown, alongside the previous and next codes. It is built for developers adding two-factor authentication to an application: generate a secret, build the otpauth:// URI and QR code your users will scan, and check that your server accepts the codes it should.
Codes are computed in your browser with the WebCrypto HMAC function, following RFC 6238 (TOTP) and RFC 4226 (HOTP), and the implementation is tested against the official test vectors in both RFCs. Nothing is sent anywhere. Even so, a TOTP secret is as sensitive as a password: anyone holding it can generate valid codes. Use this for test accounts and integration work, not as a substitute for an authenticator app on your real accounts.
How to use
- Paste a Base32 secret or press New random secret. Spaces and lowercase are fine.
- Leave algorithm, digits and period at SHA-1, 6 and 30 seconds unless your server uses something else.
- Read the current code; the ring shows how many seconds it remains valid. Copy it with the button.
- Fill in the issuer and account name to build the otpauth:// URI, then scan the QR code with an authenticator app to confirm both show the same code.
- To inspect an existing setup, paste its otpauth:// URI into the reader and press Load.
Frequently asked questions
How does a TOTP code work?
Your server and your authenticator app share a secret key. Every 30 seconds, both compute HMAC-SHA1 of the key and the number of 30-second steps since 1 January 1970, then reduce the result to 6 digits. Because both sides use the same secret and the same clock, they get the same code without communicating. That is RFC 6238; the underlying counter-based algorithm is HOTP, RFC 4226.
Why is my TOTP code not working?
By far the most common cause is a clock that is off. A difference of more than about 30 seconds puts the device in a different time step; set the device and the server to synchronise time automatically. Other causes: the secret was mistyped (Base32 uses A–Z and 2–7 only, so O, I, 0, 1 and 8 never appear), or the server expects different settings such as 8 digits, SHA-256, or a 60-second period.
Is SHA-1 in TOTP insecure?
No. The known SHA-1 weaknesses are collision attacks, which let someone create two inputs with the same hash. TOTP uses SHA-1 inside HMAC with a secret key, a construction that does not depend on collision resistance and remains secure. SHA-1 is still the default because it is what nearly every authenticator app supports.
What is an otpauth:// URI?
It is the text inside a 2FA setup QR code, in the Key Uri Format originally defined by Google Authenticator: otpauth://totp/Issuer:account?secret=BASE32SECRET&issuer=Issuer, optionally with algorithm, digits and period parameters. Scanning the QR code simply passes this string to the app. Anyone who sees the QR code or the URI has the secret, so treat setup screens as sensitive.
How long should a TOTP secret be?
RFC 4226 requires at least 128 bits and recommends 160 bits, which is 32 Base32 characters. The New random secret button generates 160 bits with crypto.getRandomValues. Many older services issue 80-bit (16-character) secrets; they work, and this tool will warn about them, but new systems should use at least 160 bits.
Do all authenticator apps support 8 digits and SHA-256?
No. The otpauth format allows SHA256, SHA512, 8 digits and other periods, but some apps ignore those parameters and always generate SHA-1, 6-digit, 30-second codes, which then do not match. If you control the server, the defaults are the safe choice. Scan the QR code from this page into the apps your users are likely to use and compare codes before shipping a non-default setting.
Adding TOTP to your own application
• Generate a random secret of at least 160 bits per user on the server, and store it encrypted, not hashed: the server needs the original to compute codes.
• Show the otpauth:// URI as a QR code, plus the Base32 secret as text for users who cannot scan.
• Require the user to enter one valid code before enabling 2FA, so a failed scan does not lock them out.
• When verifying, accept the current code and usually one step either side (the previous and next codes shown here) to absorb clock drift, and reject a code that has already been used in that window to stop replay.
• Rate-limit attempts. A 6-digit code has only a million possibilities, so unlimited guessing defeats it.
• Issue single-use recovery codes at enrolment, and hash them like passwords.
TOTP compared with SMS codes, push and passkeys
TOTP is far stronger than SMS codes, which can be intercepted through SIM-swap attacks and SS7 weaknesses, and it works offline with no phone number. Its weakness is phishing: a convincing fake login page can ask for the code and relay it to the real site within the 30-second window.
Push approvals are convenient but invite "MFA fatigue" attacks, where an attacker sends prompts until the user taps approve. Passkeys and hardware security keys (FIDO2/WebAuthn) are the only common methods that resist phishing by design, because the browser binds the credential to the real site's domain. A sensible approach is to offer passkeys first and keep TOTP as a widely supported fallback.
Related free tools
- Password Generator — Generate a strong random password, a memorable passphrase or a PIN. Runs entirely in your browser, nothing is sent or stored.
- QR Code Generator — Make a QR code for a URL, text, email, phone, SMS, Wi-Fi or contact card, in your colours, and download it as PNG or SVG. Codes never expire.
- Bcrypt Generator — Hash a password with bcrypt at the cost you choose, check a password against a bcrypt hash, and see what each part of the hash means.
- Hash Generator — Hash text or files with MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32, verify a checksum, or compute an HMAC. Files never leave your device.