TOTP code generator and otpauth:// builder
Current and next two-factor codes from a Base32 secret or otpauth:// URI, plus the provisioning URI and QR code for a new one.
Input
Result
The result will appear here.When you build or debug two-factor login, you need to see the code the server expects without reaching for your phone. Paste a Base32 secret or a full otpauth:// URI and this tool shows the code for the current 30-second window, how many seconds it has left, and the codes either side of it. Leave the input empty and it creates a new 160-bit secret with its otpauth:// URI and, if you ask, a QR code an authenticator app can scan. The work is done by otpauth (hectorm/otpauth, MIT), a maintained HOTP/TOTP library for browsers, Node, Deno and Bun.
How it works
- Codes follow RFC 6238: the Unix time divided by the period is the counter, HMAC-SHA1 (or SHA-256/512) of it under the secret is truncated to 6 or 8 digits as RFC 4226 describes.
- An otpauth:// URI carries its own algorithm, digits and period, and those win over the dropdowns; with a bare Base32 secret the dropdowns, issuer and account build the URI.
- The previous code is shown too, because most servers accept one step of clock drift either side, and a code that matches 'previous' usually means the device clock is behind.
- The QR preview encodes the full otpauth:// URI and is drawn by the qrcode package only when you switch it on.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.
What it costs
This tool is free, with no sign-in and no points.
Common questions
- My app shows a different code from this page. Why?
- Almost always a clock problem or a parameter mismatch. Check that the device's time is set automatically — a phone thirty seconds off will always be one code behind. Then check the algorithm, digits and period: many authenticator apps only honour SHA1, 6 digits and 30 seconds and silently ignore other values, so a server configured for SHA-256 or 8 digits will reject what they show.
- How long should a TOTP secret be?
- RFC 4226 requires at least 128 bits and recommends 160, which is 32 Base32 characters. The tool flags anything shorter. The popular demo secret JBSWY3DPEHPK3PXP is only 80 bits and should never be used for a real account.
- Is it safe to paste a real 2FA secret here?
- The calculation happens in this page and nothing is sent or stored, but the secret is the entire second factor: anyone who has it can produce valid codes forever. Treat a secret you have pasted into a shared machine as exposed, and re-enrol the account if in doubt. The same goes for the QR code, which contains the secret in plain text.
- What goes into an otpauth:// URI?
- The format comes from Google Authenticator's Key URI documentation: otpauth://totp/Issuer:account?secret=BASE32&issuer=Issuer, with optional algorithm, digits and period parameters. The issuer appears twice on purpose — once in the label for old apps and once as a parameter for newer ones — so both show the right name.
The open-source behind it
This tool runs on hectorm/otpauth, released under MIT. If you need the same behaviour inside your own program, that is the library to reach for.
hectorm/otpauthAlso known as
- totp generator
- 2fa code generator
- otpauth uri
- google authenticator code online
- totp test
- rfc 6238