Configuration
Current Code
------
Time-based one-time password (TOTP)
—
Key Info
Algorithm
HMAC-SHA1
Counter (T)
—
Secret (hex)
—
Secret length
—
TOTP Code Generator creates Time-based One-Time Passwords (TOTP) from a Base32 secret key, displaying the current 6-digit code and the seconds remaining until the next code. It also generates QR codes for scanning into authenticator apps (Google Authenticator, Authy, 1Password, Bitwarden). All computation runs locally in your browser — your secret never leaves your device.
TOTP is the algorithm behind authenticator apps. When you scan a QR code to set up two-factor authentication, the app stores your secret key and uses it with the current time (rounded to 30-second intervals) to compute a 6-digit HMAC-SHA1 hash. Both your app and the server compute the same code at the same time — without any network communication — which is why TOTP works offline.
This tool is useful for: testing TOTP implementation during development, recovering access if your authenticator app is lost and you saved the secret key, verifying that a TOTP secret is valid before configuring production systems, and generating codes manually when you need to log in from a device without your authenticator app.
Generate a code from a secret
Result: Secret: JBSWY3DPEHPK3PXP → Current code: 123456 (changes every 30 seconds based on current time)
Generate authenticator QR code
Result: Secret + Account name + Issuer → QR code encoding otpauth://totp/Example:alice@example.com?secret=...&issuer=Example — scan with any authenticator app
Test TOTP during development
Result: Copy the secret from your app's setup page → verify the code in this tool matches the code in your authenticator app → confirms correct TOTP implementation
What is TOTP and how does it work?
TOTP (Time-based One-Time Password, RFC 6238) computes a 6-digit code from a shared secret and the current Unix timestamp rounded to a 30-second window. HMAC-SHA1 combines the secret and timestamp. Both the client (authenticator app) and server independently compute the same code — no communication needed. After 30 seconds, the time changes and the code changes.
Is it safe to enter my TOTP secret into this tool?
This tool processes the secret entirely in your browser — it never sends data to a server. However, TOTP secrets are sensitive credentials. Use this tool for development testing or emergency code generation. For long-term use, your authenticator app is more secure because secrets remain on-device.
What is the difference between TOTP and HOTP?
TOTP (Time-based) uses the current time as the counter. HOTP (HMAC-based) uses a counter that increments with each use. TOTP is more common for user authentication because codes expire automatically after 30 seconds. HOTP is used in hardware tokens where time synchronization is difficult.
What happens if my device clock is wrong?
TOTP codes are only valid for the 30-second window they were generated in. If your device clock is off by more than 30 seconds, codes may fail. Most servers accept the previous and next code (90-second window) to account for slight clock differences. A large clock offset causes persistent authentication failures.
Can I recover my TOTP if I lose my authenticator app?
Only if you saved the original secret key or QR code. Most services show the secret once during setup — if you save it (screenshot or password manager), you can reconfigure your authenticator. If you did not save it, use the backup codes provided during setup, or contact the service's support for account recovery.