DevTools Logo

TOTP / 2FA Generator

TOTP / 2FA Generator

Generate RFC 6238 TOTP codes and QR codes for authenticator apps.

TOTP Configuration

Examples

Build a standard provisioning URI

Input
Secret: JBSWY3DPEHPK3PXP
Issuer: Example
Account: user@example.com
Period: 30
Digits: 6
Algorithm: SHA1
Output
otpauth://totp/Example:user%40example.com?issuer=Example&secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&period=30

The issuer and account form the label, and every selected TOTP parameter is included in the URI query.

Illustrative six-digit code at a fixed timestamp

Input
Secret: JBSWY3DPEHPK3PXP
Timestamp: 1700000000000 ms
Period: 30
Digits: 6
Algorithm: SHA1
Output
324550

Illustrative format example computed at a fixed timestamp. The live tool's code changes every 30 seconds.

Illustrative advanced eight-digit code

Input
Secret: JBSWY3DPEHPK3PXP
Timestamp: 1700000000000 ms
Period: 60
Digits: 8
Algorithm: SHA256
Output
71205722

Illustrative format example computed at a fixed timestamp. The live output changes with time and the selected parameters.

About this tool

TOTP / 2FA Generator creates a time-based one-time password from a Base32 secret and renders the matching otpauth provisioning URI as a QR code. Issuer and account labels are configurable, and the current code refreshes once per second with a progress bar showing the remaining validity window.

Advanced options support 30- or 60-second periods, six or eight digits, and HMAC-SHA-1, HMAC-SHA-256, or HMAC-SHA-512. These parameters are included in the provisioning URI, so an authenticator scanning the QR code can reproduce the same sequence when it supports the selected combination.

Secrets and codes are generated in the browser. A newly generated Base32 secret is created on first load and on demand; users can also paste an existing secret after spaces are removed and letters are uppercased. Anyone who obtains the secret or QR code can generate the same codes, so production enrollment material must be handled like a password.

How to use

  1. Set the Base32 secret

    Use the generated secret, click refresh for another one, or paste an existing Base32 key. Spaces are removed and letters are normalized to uppercase.

  2. Enter issuer and account

    Use labels that let an authenticator user distinguish the service and account, such as an application name and email address.

  3. Match advanced parameters

    Choose the same period, digit count, and hash algorithm required by the system that will verify the code.

  4. Provision or test

    Scan the QR code or copy the otpauth URI, then compare the authenticator's current code before the countdown expires.

Use cases

Test a TOTP verifier during development

Use a known Base32 fixture and matching parameters to compare a backend verifier against a browser-generated code.

Preview authenticator enrollment

Check the issuer, account label, QR code, and provisioning URI before implementing a 2FA setup screen.

Diagnose parameter mismatches

Switch period, digits, and algorithm to identify why two TOTP implementations produce different codes from the same secret.

Create disposable local test accounts

Generate a fresh secret and QR code for non-production integration tests without sharing enrollment material with an external service.

Common mistakes

Mistake:Sharing a production secret or QR code while troubleshooting.

Fix:Treat both as authentication credentials. Revoke and re-enroll the account if either is exposed.

Mistake:Using different period, digits, or algorithm settings on the verifier and generator.

Fix:Match all parameters exactly; the same secret alone is not enough to produce the same sequence.

Mistake:Copying a code near the end of its countdown.

Fix:Wait for the next period or submit immediately so the verifier receives it inside the accepted time window.

Mistake:Expecting a valid Base32 secret to compensate for a badly synchronized clock.

Fix:TOTP is time-based. Synchronize client and server clocks and define an appropriate verification window.

Frequently asked questions

Related guides

How TOTP 2FA Works: RFC 6238, HMAC-SHA1, and Secret Keys

Understand the Time-Based One-Time Password (TOTP) algorithm, 30-second time steps, QR code URI formats, and generating 2FA codes.

References & standards

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

Client-Side File Encryptor

Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.