How to use the TOTP Generator
- Paste the secret key from your service’s 2FA setup (the text shown under “Can’t scan the QR code?”), or click New random secret.
- The current code appears with a countdown; it changes every 30 seconds, like in your authenticator app.
- For testing your own app: copy the otpauth:// link or make a QR code from it and scan it with an authenticator.
- Type a code into Check a code to see whether it is valid right now.
How TOTP works
A time-based one-time password (TOTP, RFC 6238) is an HMAC of the current 30-second time step, keyed with a shared secret. Your phone and the server both know the secret, so both compute the same 6 digits without talking to each other. The secret is shown once during setup — usually as a QR code containing an otpauth://totp/…?secret=… link — and stored by your authenticator app.
| Setting | Usual value | Note |
|---|---|---|
| Algorithm | SHA-1 | What Google Authenticator and almost every service use; SHA-256/512 are rarely supported by apps. |
| Digits | 6 | Some banks and Steam-style tokens use 8. |
| Period | 30 seconds | Codes are accepted for a step before and after, to allow clock drift. |
Codes don’t match?
- Clock: TOTP depends on the time. Turn on automatic date and time on your phone and computer.
- Secret: copy it exactly; it is Base32 (A–Z and 2–7) — 0, 1 and 8 never appear.
- Settings: digits, period and algorithm must match what the service uses (the otpauth link says so).
Security
Codes are calculated with your browser’s built-in Web Crypto — the secret is never sent anywhere. Even so, a 2FA secret is as sensitive as a password: use this tool for development and recovery checks, not on shared computers.
Related: Password Generator, HMAC Generator, QR Code Generator.
Also searched as: 2fa code generator, totp code, authenticator code generator, google authenticator online, otp generator, otpauth uri, totp secret generator, verify totp.
Tools that pair well with the TOTP Generator
- Password Breach Checker — Find out whether a password has appeared in known data breaches — billions of leaked passwords collected by Have I Been Pwned.
- JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.
- ULID & Nano ID Generator — Generate ULIDs — 26-character IDs that sort by creation time — or Nano IDs, short URL-friendly IDs with the alphabet and length you choose.
- Nano ID Generator — Make short, random, URL-safe IDs like V1StGXR8_Z5jdHi6B-myT — the same format as the popular nanoid library.