OTP Code Generator

How to use OTP Code Generator

1. Paste the Base32 secret from your provider’s setup screen — the text shown under the QR code.
2. The current code appears, with a countdown to the next one.
3. Enter it before the countdown runs out; if it is close, wait for the next.
4. Standard parameters: 30-second period, 6 digits, HMAC-SHA1 — what almost every service uses.
5. The secret is Base32, not Base64: only A–Z and 2–7, with optional = padding.
6. Computed in your browser with the Web Crypto API; nothing is transmitted.

How a six-digit code is derived from a shared secret

The server and your device share a secret once, at setup, in that QR code. From then on nothing is transmitted. Both sides take the current Unix time, divide by thirty to get a counter, compute HMAC-SHA1 of that counter with the shared secret, and take a four-byte window from the result using the last nibble as an offset — dynamic truncation. The number modulo one million gives six digits. Because both sides compute independently from the clock, the code works offline, on a plane, with the phone in flight mode.

Why the code is not really a second factor here

TOTP is meant to be something you have, held on a separate device. A code generated on the same machine where you type the password, from a secret stored in the same password manager, is closer to a second copy of the same factor: one compromise takes both. That trade is sometimes worth making, and it is a real improvement over no second factor at all, but it is worth knowing what you have chosen. Use this tool for testing an integration, recovering access, or checking that a secret was transcribed correctly — not as your day-to-day authenticator for anything that matters.

Clock drift is the usual failure

If your device’s clock is more than about thirty seconds out, every code you generate will be rejected, because both sides derive the counter from the time. Servers normally accept the previous and next window to allow for this, giving roughly ninety seconds of tolerance. When an authenticator suddenly stops working, the clock is the first thing to check — enabling automatic network time usually fixes it outright.

Handling the secret

The secret is Base32 — A to Z and 2 to 7 — because it has to survive being typed by hand when a QR code will not scan. Spaces and lowercase are accepted and normalised. That secret is the whole credential: anyone who has it can generate valid codes forever. Store it where you would store a password, save the recovery codes the service offered at setup, and remember that a secret pasted into any web page should be regarded as worth rotating.