TOTP Generator
Generate and verify TOTP 2FA codes with an otpauth QR code
About TOTP Generator
Computes RFC 6238 codes from a Base32 secret with SHA-1, SHA-256 or SHA-512, 6 or 8 digits and 30- or 60-second steps, adding a countdown, the previous and next codes, a ±1-step verifier and an otpauth:// URI with QR code, all generated client-side. Most authenticator apps only support SHA-1, 6 digits and 30 seconds. Useful for testing 2FA enrollment and login flows or debugging clock drift.
Category: Generators.
Frequently asked questions
Why does my authenticator app show a different code?
▾
Most authenticator apps only support SHA-1, 6 digits and a 30-second period and may silently ignore other values in the URI, so keep those defaults for real enrollments. If the settings match, check the device clock: a drift of more than one step makes every code fail.
How does the code verification work?
▾
The code you type is compared with the codes for the current time step and the steps just before and after it, a window that tolerates small clock differences, as many servers do. Spaces and dashes are ignored, and the result says which step matched.
What format does the secret need to be in?
▾
An RFC 4648 Base32 string using A-Z and 2-7; lowercase letters, spaces and missing = padding are accepted. Random secrets are 20 bytes (160 bits) from crypto.getRandomValues, the length RFC 4226 recommends, and you can also paste an existing otpauth:// URI to load its settings.
Is it safe to paste a real 2FA secret here?
▾
Codes, URI and QR code are generated in your browser and nothing is sent anywhere, but the secret is as sensitive as a password: anyone with it, or with a photo of the QR code, can produce valid codes. Prefer test secrets, and re-enroll the account to get a new secret if a real one was exposed.