TOTP Generator
Live 2FA codes from a Base32 secret, with QR and otpauth link. Runs in your browser.
About this totp generator
This TOTP generator turns a two-factor secret into the same 6-digit codes an authenticator app shows, live, with a countdown to the next one. Developers use it to test a 2FA login flow, and admins use it to check that a secret was copied correctly before handing it to a user.
Paste a Base32 secret or a full otpauth:// link and the code appears at once, with the previous and next codes beside it. You can set SHA-1, SHA-256 or SHA-512, 6 to 8 digits and a 30 or 60 second period, then check any code against a drift window. The page also builds the otpauth link and a QR code you can scan into an app.
The secret never leaves your browser. It isn't sent to a server, saved, or written into the page address. That matters, because anyone with the secret can make your codes forever.
Features
Live codes with a countdown
The current code updates on the period boundary, with a ring showing the seconds left. The previous and next codes are shown too, which helps when a server allows one step of drift.
Reads otpauth:// links
Paste the link hidden behind a setup QR code and the secret, issuer, account, algorithm, digits and period are filled in for you. HOTP links are recognised and explained rather than silently misread.
Base32, hex or text secrets
Spaces, hyphens, lowercase and = padding are cleaned up. If you paste a 0, 1, 8 or 9, the error tells you Base32 doesn't use them and that the secret may be hex instead.
Code checker with drift window
Type a code and see whether it matches now, one step behind or one step ahead. Choose a window of 0, 1 or 2 steps to match your server's setting.
QR code and setup link
The otpauth link is built from your settings and drawn as a QR code you can scan with any authenticator app, or download as an SVG for documentation.
Test vectors built in
One click loads the RFC 6238 SHA-1 test secret at Unix time 59, which must give 94287082. A fixed-time mode lets you check any other timestamp.
How to use the totp generator
- 1Paste a Base32 secret or an otpauth:// link, or make a new random secret.
- 2Set the algorithm, digits and period. The code updates live with a countdown.
- 3Check a code with a drift window, or copy the otpauth link and QR code to set up an app.
When to use it
Testing a 2FA login you built
Generate a secret here, store it for a test user, then log in with the code shown. If your server rejects it, the checker tells you whether the problem is clock drift or a wrong setting.
Checking a secret before you enrol
Paste the setup key a service shows you and compare the code with the one your app shows after scanning. If they match, the secret was copied correctly.
Writing setup docs
Make a demo secret and download the QR code as an SVG for a screenshot in your guide. You can also scan an existing QR code to read the otpauth link out of it.
How does TOTP work?
TOTP is defined in RFC 6238. It builds on HOTP from RFC 4226. The server and your app share a secret key. To make a code, they take the current Unix time, divide it by the period (30 seconds by default) and round down. That number is the time step.
The time step is run through HMAC with the secret, using SHA-1 unless both sides agree on something else. Four bytes are picked out of the result, turned into a number, and the last 6 digits become the code. Because both sides do the same maths with the same clock, they get the same code without talking to each other.
Right now the time step is about 59.8 million, since roughly 1.79 billion seconds have passed since 1970. You can see the exact step under the current code.
Why don't my TOTP codes match?
Usually it comes down to one of these:
- The clock is wrong. A phone or PC that is 30 seconds off is a whole step out. Turn on automatic time and try again.
- The settings differ. A service that uses SHA-256 or 8 digits gives different codes from one using SHA-1 and 6 digits, even with the same secret.
- The secret is in the wrong format. A hex secret read as Base32, or a secret with a stray O for 0, gives codes that look fine but never match.
- The app ignores the settings. Some apps, including older versions of Google Authenticator, assume SHA-1, 6 digits and 30 seconds whatever the link says, so stick to those defaults for public sign-ups.
What is an otpauth:// link?
It's the text inside a 2FA setup QR code. The format was defined by the Google Authenticator project and is now read by nearly every app. A typical one looks like otpauth://totp/Acme:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Acme.
The part after totp/ is the label shown in the app. The secret parameter is the Base32 key, and issuer, algorithm, digits and period are optional. If you can make a QR code from this text, any authenticator can add the account.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Where codes are made | In your browser | Sometimes on a server |
| otpauth link input | Paste to fill every field | Secret only |
| Algorithms and digits | SHA-1, SHA-256, SHA-512; 6 to 8 digits; 30 or 60 s | SHA-1 and 6 digits |
| Code checker | Drift window with step offset | Not offered |
| QR code | Built from your settings, SVG download | Often missing |
Tips
- Use a 20-byte (160-bit) secret, which is what New random secret makes. RFC 4226 asks for at least 128 bits.
- Never put a real secret into a QR code that ends up in a screenshot, ticket or chat. Anyone who scans it gets the account's second factor.
- Reject a code that was already used in the same time step. RFC 6238 says a verifier must not accept the same code twice.
- Store TOTP secrets encrypted at rest. Unlike passwords they can't be hashed, because the server needs the raw secret to make codes. If you're comparing options, the HMAC generator shows the primitive TOTP is built on.
Questions
What is a TOTP generator?
It is a tool that makes time-based one-time passwords from a shared secret, the same codes an authenticator app shows. This one runs in your browser and also builds the otpauth link and QR code for the secret.
Is it safe to paste my 2FA secret here?
The secret stays in your browser and is never sent or stored. Even so, treat a real secret like a password. For testing, a new random secret is the safer choice.
Where do I find my TOTP secret?
Most services show it as a setup key or a can't-scan link next to the QR code during 2FA setup. If you only have the QR code, scan it to read the otpauth link and copy the secret parameter.
How long is a TOTP code valid?
For one period, usually 30 seconds. Many servers also accept the previous and next code to allow for clock drift, so in practice a code works for up to about 90 seconds.
Can I use this instead of an authenticator app?
Not for real accounts. A browser tab that holds your secret is easier to lose or expose than an app on your phone. Use this page to test and check secrets, and keep daily logins in an authenticator app.
What's the difference between TOTP and HOTP?
HOTP (RFC 4226) moves to the next code each time you press a button, using a counter. TOTP (RFC 6238) uses the current time instead, so codes change every 30 seconds on their own. Most 2FA today is TOTP.
Should I choose SHA-256 or SHA-512?
Only if every app your users have supports it. SHA-1 is still safe for TOTP because HMAC doesn't rely on the collision resistance that broke SHA-1 for certificates, and it is what all apps support.