TOTP Generator
Paste a Base32 secret or an otpauth URI and get live one-time codes. Choose SHA-1, SHA-256 or SHA-512, 6 or 8 digits, and a 30 or 60 second period. Everything runs locally.
How to use
- Paste the Base32 secret from the site's security settings into the box. Spaces, dashes and lower case letters are handled automatically. A full otpauth:// URI works too.
- When you paste a URI, the tool extracts the secret, issuer and account, and syncs the algorithm, digit count and period into the options below.
- The current code appears live in large grouped digits. The bar and the countdown show how much of the window is left, then the code rolls over on its own.
- Press Copy code to put the code on the clipboard without spaces, then paste it into the verification page. The next code is shown in advance.
- Codes use this device's clock. If a code is rejected, sync the system time first, then check the algorithm, digits and period options.
FAQ
Do the codes match authenticator apps?
Is my secret uploaded or stored anywhere?
Why is my code always rejected?
When should I use 8 digits or 60 seconds?
How to use
- Paste the secret
Copy the Base32 secret from the website into the box. Spaces, dashes and lower case letters are handled automatically. A full otpauth:// URI works as well and fills in every parameter it carries.
- Check the options
Most sites use SHA-1 with 6 digits over a 30 second period, which are the defaults here. A few services ask for SHA-256, 8 digits or 60 seconds, and a parsed URI applies those on its own.
- Read the current code
The large number is the code that is valid right now, split into groups so it reads easily. The bar and the countdown show how much of the window is left, and the code rolls over on its own.
- Copy and submit
Press Copy to place the code on the clipboard without spaces, then paste it into the verification page. If only a couple of seconds remain, wait for the next window before you copy.
About this tool
A time based one-time password, usually shortened to TOTP, is the most common form of two-step verification today. When you enable it, the site shows a Base32 secret that both sides keep. At login, the site and your authenticator run the same calculation. The current time is divided by the period to produce a counter, and the counter and the secret go through an HMAC hash. A few digits are picked from the result. Every period the counter increases and the code changes. Neither side needs to contact the other, because matching secrets and roughly matching clocks produce the same number.
This page performs the whole calculation in your browser. The secret is decoded from Base32 into raw bytes. The HMAC signature comes from the browser's built in Web Crypto interface. The truncation and modulus steps run in the page script. Nothing leaves this page. Alongside the current code the page shows the next one, which is handy when the window is about to end. Pasting an otpauth URI also syncs the algorithm, digit count and period into the options. Codes are computed from this device's clock, so a badly skewed clock is the usual reason a code does not match.
How it works
TOTP grew out of HOTP, and both are specified in RFC documents. HOTP counts events shared by both sides. TOTP derives the counter from time: the Unix timestamp in seconds is divided by the period, usually 30 seconds, and rounded down. The counter is written as an 8 byte big endian number and then hashed with the key through HMAC-SHA-1. That yields a 20 byte digest. Dynamic truncation reads the low four bits of the last byte as an offset, then takes four bytes at that position. The top bit is masked off into a 31 bit number, which is reduced modulo ten to the power of the digit count. The RFC test vectors for SHA-1, SHA-256 and SHA-512 all pass.
Secrets travel in Base32 for good reasons. The alphabet holds only the letters A to Z plus the digits 2 to 7. It avoids the easily confused 0, 1, 8 and 9, ignores letter case, and survives hand copying and dictation. Many sites also insert a space every four characters to make reading easier. As for security, the visible code is only a derivative, while the secret is the real credential, so the secret must never leave your devices. Servers usually accept a code from one window earlier or later, which absorbs small clock errors. Switching to SHA-256 or SHA-512 changes only the digest length, and compatibility is decided by the server.
When to use it
- Enabling two-step login
When a site offers the cannot scan option during setup, it prints a Base32 secret. Paste it here, type the generated 6 digit code back into the site, and finish the pairing. One test login afterwards confirms that both sides produce the same numbers.
- Migrating to a new phone
Before replacing a phone or reinstalling an authenticator, export the secrets of every account. Paste each one here and compare the codes with the live site. A matching code proves the backup is intact, long before a lockout reveals a typo.
- Servers and intranets
Company VPNs, jump hosts and admin panels often require a dynamic code. While enabling or resetting two-step verification, confirm the algorithm and the period on this page first. A wrong parameter there can lock the whole team out of production. Testing one generated code before rollout keeps the setup clean and saves a support ticket.
Tips & tricks
- Wait for a fresh window when the countdown is under five seconds, so the code survives a slow paste.
- If nothing happens after pasting, look for stray full width characters or a truncated copy and try again.
- Most services use SHA-1, 6 digits and 30 seconds. Only change the defaults when the site says so.
Things to watch
- The secret is the credential
The visible code is temporary, while the Base32 secret is the long term credential. Never type the secret into the code field, and never share a screenshot of it. Anyone holding that secret can generate your codes at any time, on any device.
- Clock drift breaks matching
Codes are computed from this device's clock, so a clock that runs fast or slow produces numbers the server rejects. Sync the system time first, and check that the digits, algorithm and period still match the site settings. Skew beyond one window is the usual offender.
- Hand copied secrets fail
Base32 never contains the digits 0, 1, 8 or 9. If a copied secret shows them, some letter such as O, I or B was misread along the way. Go back to the setup page and copy the secret again instead of guessing the difference.