TOTP · RFC 6238
TOTP Generator
Create a TOTP secret, watch the current one-time code count down, scan the QR code into an authenticator app and check that both show the same code.
••• •••
A TOTP secret is the key to a second factor. Use secrets made here for testing and development, and never paste the secret of a real account into any website - this one included.
Add it to an authenticator app
Enter a valid secret.
Secret from crypto.getRandomValues(), codes from Web Crypto HMAC, QR code drawn on this page. Nothing is sent. Verify it
How TOTP Works
TOTP, the Time-Based One-Time Password algorithm, is defined in RFC 6238. The service and your authenticator app share one secret. To make a code, each side:
- counts the 30-second steps since 1 January 1970 - at 00:00:59 that count is 1;
- computes an HMAC-SHA-1 of that count with the secret as the key;
- picks 4 bytes from the result and turns them into a 6-digit number.
Both sides get the same number without talking to each other, so the code works even when your phone is offline. With the test secret from the RFC, the code at 00:00:59 is 287082 - the value this page computes, and the one the RFC lists (as the last six of its eight digits).
The secret travels only once, when you set up 2FA: the service shows it as a QR code that contains an otpauth:// link, in the Key URI format that authenticator apps read. The tool above builds the same link and QR code.
OTP Generator: HOTP and TOTP
A one-time password is valid for a single use. The two open standards differ only in what changes between codes:
| HOTP | TOTP | |
|---|---|---|
| Standard | RFC 4226 (2005) | RFC 6238 (2011) |
| Moving part | A counter, +1 per code | The time, in 30-second steps |
| A code expires | When a later one is used | After its time step |
| Example (RFC secret) | count 1287082 | 00:00:59287082 |
The two examples are the same number on purpose: TOTP is HOTP with the time step as the counter, and 59 seconds is step 1.
Testing 2FA With an Authenticator App
- Press "New secret" - the tool makes a random 160-bit secret.
- Scan the QR code with your authenticator app, or type the secret into the app's "enter a setup key" option.
- Compare: the app and this page should show the same code, changing at the same moment. Type the app's code into "Check a code" to confirm.
- Delete the test entry from your app when you are done.
Developers can use the same steps to test their own 2FA setup flow: scan the QR code their app shows into an authenticator, then paste the secret here to compare codes.
The Secret Is the Second Factor
Whoever has a TOTP secret can make every future code for that account, without your phone. That is why the secret of a real account should never be pasted into a website - including this one - or stored next to the password. Keep it in your authenticator app and keep the service's backup codes somewhere safe, in case the phone is lost.
TOTP is a big step up from a password alone, but it is not phishing-resistant: a code typed into a fake page can be reused within its 30 seconds. Where a service offers passkeys or security keys, they protect better.
TOTP Generator FAQs
Can I use this to get codes for my real accounts?
You could, but you should not. Anyone who has a TOTP secret can make your codes, so the secret of a real account belongs only in your authenticator app and with the service. Use this page with secrets it generates - for testing a login flow, a demo or learning how TOTP works.
Why does the code from my app not match?
Usually one of three things: the phone's clock is off (turn on automatic time), the secret was typed with a mistake, or the app does not support the settings - many apps handle only SHA-1, 6 digits and 30 seconds. The check box accepts the previous and next code as well, to allow for small clock differences.
Is the secret sent anywhere?
No. The secret is generated with crypto.getRandomValues(), the codes are computed with the browser's Web Crypto HMAC, and the QR code is drawn on the page - not by an online QR service. The secret is not put in the address and is cleared when you leave the page.
What is the difference between OTP, HOTP and TOTP?
OTP is any one-time password. HOTP (RFC 4226) counts: each code uses the next number of a counter. TOTP (RFC 6238) is HOTP where the counter is the current time in 30-second steps, so codes expire on their own. Authenticator apps almost always use TOTP.
How long should a TOTP secret be?
RFC 4226 requires at least 128 bits and recommends 160. Secrets made here are 160 bits - 32 Base32 characters. Some services use shorter ones; the tool still works with them but warns below 128 bits.
Are TOTP codes safe against phishing?
No. A fake login page can ask for the code and use it on the real site within the same 30 seconds. Security keys and passkeys are phishing-resistant because the browser ties them to the real site. See what 2FA is for how the methods compare.
Related guides
What Is Two-Factor Authentication?
How Passwords Get Cracked
