TOTP Generator

About TOTP generator

Time-based one-time passwords, defined in RFC 6238, are the six-digit codes that change every 30 seconds in an authenticator app. This tool computes them from a Base32 secret, shows the current and next code with a countdown ring, and builds the otpauth URI that authenticator apps import, which is handy for testing a two-factor login you are building.

How to use it

1. The page starts with a random 20-byte Base32 secret. Paste your own into Base32 secret, or select Random secret for another.
2. Choose the HMAC algorithm (SHA1, SHA256 or SHA512) and 6 or 8 digits.
3. Read the Current code, the countdown ring and the Next code badge, and use Copy code to take it.
4. Optionally fill Issuer and the second label field, then copy the otpauth:// URI to import elsewhere or turn into a QR code.

RFC 6238 test vector (SHA1, Unix time 59)

Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, which is the ASCII text 12345678901234567890 in Base32

94287082 with 8 digits, and 287082 with 6 digits. The tool follows your device clock, so this shows what the algorithm produces at that instant rather than what you will see now.

When to use it

• Testing the verification code path of a two-factor login against a code you can generate yourself.
• Recovering the current code from a backed-up secret when your phone is unavailable.
• Checking whether a mismatch is a clock-skew problem by comparing the current and next codes.
• Making an otpauth URI to hand to a QR code generator for a demo.

Questions about TOTP generator

Why does my code not match the app?

The usual causes are a different secret, an unsynchronised device clock, or different settings. The period here is fixed at 30 seconds, and some authenticator apps ignore the digits or algorithm options in the URI.

What is inside the 6 digits?

HMAC of the number of 30-second steps since 1970, then dynamic truncation: the last byte picks an offset, four bytes are read from it, the top bit is cleared, and the value is reduced modulo one million.

Which characters can appear in the secret?

Base32 letters A to Z and digits 2 to 7. Spaces, hyphens, lowercase and equals padding are tolerated. Anything else, like 0 or 1, produces an invalid-character error naming the character.

Is SHA1 still fine for TOTP?

Yes. HMAC-SHA1 is not weakened by SHA-1's collision attacks, and it is the default that virtually every authenticator app supports. SHA256 and SHA512 are available where both sides agree.

How long should a secret be?

RFC 4226 asks for at least 128 bits and recommends 160 bits. The random secret here is 20 bytes, which is 160 bits and 32 Base32 characters.

Related tools

• Base32 encoder and decoderEncode text to Base32 or decode Base32 back to text following RFC 4648, with optional padding and the Base32hex alphabet.
• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text
• JWT DecoderDecode and inspect JWT tokens — view header, payload claims, expiry, and signature.
• Whirlpool GeneratorGenerate a Whirlpool hash from text