TOTP and HOTP Code Generator
Generate TOTP and HOTP 2FA codes from a Base32 secret or an otpauth:// URI, with SHA-1, SHA-256 or SHA-512, a live countdown and a QR code for 2FA apps.
A 2FA secret is as sensitive as a password. Everything here runs locally in your browser: the secret, the codes and the QR code are never sent anywhere.
- Previous code
- —
- Current code
- —
- Next code
- —
TOTP codes depend on your device clock. If they do not match, check that the clock is set automatically.
Set up an authenticator app
Add an issuer and an account name, then scan the QR code or copy the otpauth:// link into your authenticator app.
How to generate TOTP codes
- Paste a Base32 secret (for example
JBSWY3DPEHPK3PXP) or a completeotpauth://link into Secret (Base32) or otpauth:// URI. Spaces, hyphens, lowercase letters and missing=padding are accepted. - The codes appear as you type, or when you click Show codes. A pasted URI fills in the Type, Algorithm, Digits, Period (seconds), Issuer and Account fields for you.
- Read the Current code in the middle, with the Previous code and Next code on either side. The bar below counts down the seconds before the code changes, and Copy code copies it without the space.
- For counter-based codes, choose HOTP (counter-based), set the Counter and use Next counter to move forward.
- To create a new 2FA secret, click New random secret. Fill in Issuer and Account, then scan the QR code with an authenticator app, Copy URI, or Download QR code (PNG).
How TOTP and HOTP work
HOTP (RFC 4226) computes an HMAC of an 8-byte counter with the shared secret, then applies dynamic truncation: the last four bits of the HMAC pick an offset, four bytes are read from there, the top bit is cleared and the number is reduced modulo 10^digits. The result is a 6- to 8-digit code.
TOTP (RFC 6238) is HOTP where the counter is the current time step: T = floor(Unix time / period), with a period of 30 seconds by default. Your phone and the server compute the same code independently, because they share the secret and (roughly) the same clock. That is why the Previous code and Next code are shown: servers usually accept one step before or after to tolerate clock drift.
The HMAC runs with your browser’s Web Crypto API using SHA-1, SHA-256 or SHA-512. SHA-1 with 6 digits and 30 seconds is what almost every service uses; SHA-256 and SHA-512 are allowed by RFC 6238 but some apps ignore them, so change the defaults only if the service asks for it.
The otpauth:// URI and QR code
Authenticator apps are set up with a URI such as otpauth://totp/Example:alice@example.com?secret=…&issuer=Example&algorithm=SHA1&digits=6&period=30, usually shown as a QR code. This tool reads such URIs (including percent-encoded labels like ACME%20Co) and builds new ones. The QR code is drawn locally from the URI shown under otpauth:// URI.
A new random secret has 20 bytes (160 bits), the length recommended by RFC 4226, taken from crypto.getRandomValues.
Security tips
- The secret is the second factor itself: anyone who has it can produce your codes. Do not paste the secrets of important accounts on shared computers, and never share screenshots of the QR code.
- Everything is computed locally; nothing is sent over the network. Close the tab when you are done.
- Keep backup codes from the service: a secret you lose cannot be recovered.
Frequently asked questions
Why does my code not match the one in my app?
Check your device clock first: TOTP codes change every period, so a clock that is off by more than about 30 seconds gives different codes. Then check that the algorithm, digits and period match what the service used.
Is this tool compatible with Google Authenticator and similar apps?
Yes. It follows RFC 6238 and the otpauth URI format those apps use. Scan the QR code or type the Base32 secret in the app, and both should show the same Current code.
What is the difference between TOTP and HOTP?
TOTP moves forward with time, so a code expires after the period. HOTP moves forward with a counter that increases each time a code is used, so a code stays valid until it is used or replaced.
Can I use this tool as my everyday authenticator?
It is meant for testing, development and recovery. A phone app or a hardware key is safer for daily use, because the secret does not have to be pasted into a web page each time.
Were the calculations checked against the standards?
Yes. The tool is tested with the RFC 4226 Appendix D HOTP values and the RFC 6238 Appendix B TOTP values for SHA-1, SHA-256 and SHA-512.
Related tools
- HMAC Generator Compute an HMAC-SHA1, SHA-256, SHA-384 or SHA-512 with a text, hex or Base64 key, get hex and Base64 output, and check a webhook signature in your browser.
- Password Generator Free password generator that creates strong random passwords of 4 to 128 characters in your browser with a secure RNG. Nothing is stored or sent.
- QR Code Generator Create free QR codes for links, text, Wi-Fi, contacts, email and SMS. Add colors and a logo, then download PNG or SVG. Nothing leaves your device.
- Shamir Secret Sharing Split a password or recovery phrase into N shares so that any M of them rebuild it, with Shamir's secret sharing over GF(256), locally in your browser.