TOTP Generator (One-Time Password)

Generate the same 6-digit codes as Google Authenticator or any 2FA app from a Base32 secret, create new secrets, and build otpauth:// links — ideal for developers testing two-factor login.

Code refreshes in
otpauth:// URI

How TOTP works

TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind most authenticator apps. When you enable two-factor authentication, the website and your app share a random secret key, usually shown as a QR code or a Base32 string like JBSWY3DPEHPK3PXP. Then, every 30 seconds:

  1. Both sides take the current Unix time and divide it by 30 to get a counter.
  2. They compute HMAC-SHA1(secret, counter).
  3. A 4-byte slice of the result is turned into a 6-digit number.

Because both sides do the same math with the same secret, the codes match — without any network connection between your phone and the server.

What you can do with this tool

  • Test your 2FA implementation. Paste the secret your app generated and compare codes.
  • Create a new secret. Click New secret for a random 160-bit key, as recommended by RFC 4226.
  • Build an otpauth:// URI — the exact string encoded in enrolment QR codes — with issuer, account, digits, period and algorithm.
  • Debug clock problems. If codes don’t match, the most common cause is a device clock that is off by more than 30 seconds.

Settings explained

Almost every service uses the defaults: 6 digits, 30-second period, SHA-1. Some enterprise and banking systems use 8 digits or SHA-256. Changing these only works if the server is configured the same way.

Important: Don’t use a web page as your everyday authenticator for real accounts. The secret is what protects your account; it belongs in a dedicated authenticator app or password manager on a device you control. This tool is for development, testing and learning.

TOTP vs. SMS codes vs. passkeys

TOTP codes are much safer than SMS, which can be intercepted through SIM-swapping. They can still be phished in real time, though. Passkeys and hardware security keys (FIDO2/WebAuthn) are phishing-resistant and are the strongest option where available.

Last updated: · Reviewed by the Password Generator team

Frequently asked questions

Is this compatible with Google Authenticator?

Yes. With the default settings (SHA-1, 6 digits, 30 seconds) it produces the same codes as Google Authenticator, Microsoft Authenticator, Authy and other RFC 6238 apps for the same secret.

Why don’t my codes match?

Check that the device clocks are correct, that the secret was copied without mistakes, and that digits, period and algorithm match the server’s settings.

Is the secret sent to your server?

No. Codes are calculated in your browser with the Web Crypto API. Nothing is transmitted or stored.

What is an otpauth URI?

It is the text encoded in a 2FA enrolment QR code, for example otpauth://totp/MyApp:user@example.com?secret=…&issuer=MyApp. Authenticator apps read it to set up an account.

Related tools