TOTP generator
Enter a base32 secret to see the current 6 to 8 digit code that an authenticator app would show, refreshed every period. Useful for testing two-factor setups; you can also create a random secret.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Enter a base32 secret, or press Random secret.
- Leave the defaults (6 digits, 30 seconds, SHA1) unless your service says otherwise.
- Read the code; the countdown shows when it changes.
How it works
The step number is the Unix time in seconds divided by the period, rounded down. It is written as 8 bytes and signed with HMAC using the decoded secret. The last four bits of the result pick 4 bytes, which are read as a 31-bit number, and the code is that number modulo 10 to the power of the digit count. Test vector from RFC 6238: secret 12345678901234567890 at time 59 gives 94287082 with 8 digits.
Tips
- Time zones do not matter; only the Unix time is used.
- Many services also accept the previous or next code to allow for clock drift.
- Some authenticator apps ignore the algorithm setting, so SHA-1 is the safe choice for real use.
Frequently asked questions
What is TOTP?
Time-based One-Time Password, defined in RFC 6238. The code comes from an HMAC of the shared secret and the current time divided into steps, usually 30 seconds, then cut down to 6 to 8 digits. The server does the same sum and compares.
Why does my code not match my phone?
Check that the secret, digits, period and algorithm are the same, and that this device's clock is correct, because the code depends on the time. Authenticator apps almost always use SHA-1, 6 digits and 30 seconds.
Is it safe to enter my real secret?
The code is computed locally and nothing is sent. Even so, a real two-factor secret is as sensitive as a password, so prefer test accounts here and keep real secrets in an authenticator app.
What is the otpauth URI for?
It is the key URI that authenticator apps read when you scan a QR code. Paste it into a QR code generator to enrol a test account.
How is the random secret made?
It is 20 random bytes (160 bits) from the browser's secure generator, shown in base32. RFC 4226 recommends at least 128 bits and 160 bits is the usual size.