What TOTP Generator helps you do

Time-based one-time passwords are short-lived codes derived from a shared secret and the current time. This tool turns a Base32 secret into the current code with a live countdown, and produces the standard otpauth:// URI and QR used to enroll an authenticator app. It is a testing and recovery utility, not a place to keep your everyday 2FA secrets.

Secrets, codes, the otpauth URI, and the QR image are all generated in your browser. Nothing is uploaded, logged, or stored.

How it works

The Base32 secret is decoded, combined with the current time step, and hashed with the selected algorithm. The result is truncated to the chosen number of digits, following the TOTP construction. The page recomputes the code when the time step rolls over and renders the same parameters into an otpauth:// URI for the QR.

How to use TOTP Generator

Paste a Base32 secret, or select Generate random secret to create one.
Set issuer, account, algorithm, digits, and period to match the service that issued the secret.
Read the current code, copy it, or scan the QR with an authenticator app.
Re-check the code after the countdown reaches zero to confirm the next step.

When to use it

Verifying that your server-side TOTP implementation matches a standard authenticator.
Enrolling a test account in an authenticator app without juggling devices.
Recovering access when you have the secret but no enrolled device.
Checking the effect of a 30- versus 60-second period.
Confirming that a 6- or 8-digit configuration matches the issuer.
Teaching how a time step and a shared secret produce a code.

When not to use it

Do not paste production 2FA secrets into a shared or untrusted machine.
Do not use it as your everyday authenticator; it keeps no vault.
Do not expect it to recover a secret you no longer have.

Example

A backend developer pastes the test secret and selects SHA-1, 6 digits and 30 seconds. The code matches the server's test vector. A second run with SHA-256 produces a different code, which explains why the server rejected the first configuration.

What you can do with TOTP Generator

Generate the current TOTP code from a Base32 secret.
Show a live countdown to the next code.
Create a random secret for testing.
Set issuer, account, algorithm, digits and period.
Generate an otpauth:// URI and QR for enrollment.
Copy the current code with one click.

Example: verify a server implementation

Paste the same Base32 secret the server uses, then match the algorithm, digit count and period from the server's configuration. A mismatch in any one of them produces codes that never agree.

Compare the tool's current code with the server's expected code for the same time step. If they differ, check the secret encoding and the device clock before changing the server code.

For a test account, scan the QR with an authenticator app and confirm that both produce the same code. Do not use a production secret for this check on a shared machine.

What to know before you start

Anyone who has the secret can generate valid codes, so treat it like a password.
Algorithm, digit count, and period must match the issuer exactly or codes will be rejected.
A device clock that drifts more than one period produces failing codes.
This is a general TOTP utility, not a password manager; it keeps no vault.
It does not validate a code against a server or recover a lost secret.

Common mistakes

Mismatching the algorithm, digit count or period with the issuer.
Using a secret with invalid Base32 characters such as 0 or 1.
Assuming the code is valid for the whole 30 seconds on a clock that drifts.
Sharing a screenshot that includes the secret or the QR.
Treating a passing test code as proof that the whole login flow is secure.
Using a 60-second period on a server that expects 30 seconds.

Troubleshooting

If the code does not match, check all four parameters: secret, algorithm, digits and period.

If the code is rejected near the end of the window, the server may allow less clock skew than the client.

If the secret is rejected, remove spaces or hyphens and confirm the Base32 alphabet.

If the countdown looks wrong, check the device clock; a large drift changes the time step.

If the QR will not scan, confirm the issuer and account fields are short enough and the app supports the URI.

TOTP Generator