How to use the TOTP secret generator
- Type the Issuer (service name) and the Account (usually an email address). They label the entry in the app.
- Pick the Secret size: 80 bits, 160 bits (RFC 4226) or 256 bits.
- Choose Digits (6 or 8), Period (30 s or 60 s) and Algorithm (SHA-1, SHA-256 or SHA-512).
- Press Generate. You get the Secret (Base32), the otpauth:// URI, a QR code to scan (downloadable as
totp-qr.svg), the Current code and how long it is Valid for. - Scan the QR code with an authenticator app and compare its code with the one shown.
What it does and when to use it
Time-based one-time passwords (TOTP) are the six-digit codes that authenticator apps show for two-factor login. The server and the app share a secret; both mix it with the current time to get the same short code.
Use it to test your own 2FA sign-up screen, to set up a demo account for a training session, or to check that a library computes codes correctly. For one-off codes from a secret you already have, see the OTP generator. For other secrets, try the encryption key generator or the strong password generator.
How it works
- Secret: random bytes from
crypto.getRandomValues(10, 20 or 32 bytes), written in Base32 with the letters A–Z and digits 2–7. A 160-bit secret is 32 characters; the tool shows it in groups of four for easier typing. - Code: the time since 1970 is divided by the period to get a counter. The counter is signed with HMAC using the secret and the chosen hash (through the browser’s Web Crypto API). Four bytes of the result are turned into a number, and the last 6 or 8 digits are the code (RFC 4226 and RFC 6238).
- QR code: drawn as an SVG by the qrcode library that is part of this site, from the otpauth:// URI.
Worked examples
- Defaults. The URI starts
otpauth://totp/ToolsRift%20Test%3Auser%40example.com?secret=and ends&issuer=ToolsRift+Test&algorithm=SHA1&digits=6&period=30. - No issuer, 8 digits, SHA-256, 80-bit secret. The secret is 16 characters, the label falls back to
user, and the URI endsalgorithm=SHA256&digits=8&period=30. - 60-second period. The code lasts twice as long, and the warning “The secret is the whole credential…” is shown with every result.
Limits and tips
- Keep device clocks correct. A clock that is a period or more out can give wrong codes.
- Store secrets on the server encrypted, and offer backup codes in case a phone is lost.
- The QR code holds the secret in plain text. Treat the image like a password.
Frequently asked questions
Who is this tool for?
Mainly developers who are adding two-factor login to an app and need a test secret, a sample QR code, or a way to check that their server computes the same code as an authenticator app. When you turn on 2FA for an existing account, that service makes the secret for you.
Which settings work with Google Authenticator and similar apps?
The defaults are 160-bit secret, 6 digits, 30 seconds and SHA-1. These are the usual defaults from RFC 4226 and RFC 6238 and work with nearly every app. Some apps ignore the 8-digit, 60-second, SHA-256 or SHA-512 options and quietly fall back to the defaults, which gives wrong codes. Test before you rely on them.
Is the secret safe to use?
It is made from crypto.getRandomValues on your device and never sent anywhere. But the secret is the whole credential. Anyone who sees it, or a screenshot of the QR code, can produce valid codes forever. Do not paste a real secret into chat or tickets.
Why does the current code not change?
The code is worked out once, when you press Generate, and the tool shows how many seconds it had left. Press Generate again for a new secret; your authenticator app will keep showing fresh codes for the one you scanned.
How do we know nothing is uploaded? Test it yourself on the privacy proof page.