About this TOTP generator
TOTP, the Time-based One-Time Password algorithm in RFC 6238, is what authenticator apps use for two-factor login codes. This tool computes the same codes from a base32 secret, shows how long the current code is valid, and lets you check a code you were given. It can also create a fresh secret together with an otpauth:// QR code for enrolling in an authenticator app. Everything runs on your device, using your device clock. No secret is sent anywhere or stored.
How a code is made
- The secret is decoded from base32 into bytes.
- The current Unix time is divided by the period, normally 30 seconds, to give a step counter.
- The counter is signed with HMAC (SHA-1 by default) using the secret as the key.
- A 4-byte slice of the result, chosen by its last digit, is converted to a number and cut down to 6 or 8 digits.
Two devices with the same secret and the same time make the same code, so no network is needed. The code changes at each period boundary.
Verify a code
The verifier checks a code against the previous, current and next time steps. Servers accept that small window because clocks drift and because typing a code takes a few seconds. The result tells you which step matched, so you can tell whether a clock is running early or late.
Making a new secret
The generator creates 20 random bytes (160 bits) and writes them in base32, which is the length most services use. The QR code holds an otpauth://totp/ link with the account name, issuer, secret, algorithm, digits and period. Authenticator apps such as Google Authenticator, Microsoft Authenticator, Authy, 1Password and Aegis can read it. Most apps ignore a non-default algorithm or period, so keep the defaults (SHA-1, 6 digits, 30 seconds) unless you control both sides.
Good to know
- Treat the secret like a password. Anyone holding it can make valid codes. Do not paste a secret from an account you care about into any site you do not trust. This page keeps it in your browser only, but a shared computer is a risk.
- Time must be right. A device clock that is more than about 30 seconds off gives codes that servers reject.
- Not a replacement for an authenticator app. It is a tool for testing, development and recovery of known secrets.
For random strings and passwords, use the password generator, and to read or build QR codes see the QR code generator.
Frequently asked questions
A TOTP code is a short number, usually six digits, calculated from a shared secret and the current time. It changes every 30 seconds and is used as a second step when signing in.
The calculation runs in your browser and the secret is not uploaded or saved. Still, avoid entering the secret for an important account on a computer you do not trust, because anyone who learns the secret can generate your codes.
Check the secret, the digits, the period and the algorithm; all must match. Also check that this device's clock is correct, because the code depends on the time.
It computes the codes for the previous, current and next time step and compares them with the one you typed. It shows which step matched, if any.
Scan the QR code with an authenticator app, or type the secret into the app by hand. Then save the secret in a safe place and give the server the same value so it can verify codes.
Google Authenticator, Microsoft Authenticator, Authy, 1Password, Aegis and most other TOTP apps read the standard otpauth link. They normally use SHA-1, 6 digits and 30 seconds.