TOTP Generator: 2FA Codes from a Secret, with HOTP

How to use it

Type the secret from the service's two-factor page into the field, or paste the otpauth:// text its QR code holds. Press Show to check what you typed.
Choose the Hash, the Digits and the Period the service names. Many services use the defaults of the Key URI Format: SHA-1, 6 digits and 30 seconds.
For a counter-based service, choose Counter-based (HOTP) and enter the counter; Counter + 1 moves it on.
Enter the Current code before the Time left runs out, and check the Previous and Next codes if the clock of your device is a little off.

How a code is made

HOTP (RFC 4226) takes the secret key and a counter, makes an HMAC of the counter with the hash, and takes four bytes of it (dynamic truncation). The number those bytes give, modulo 10 to the power of the digits, is the code.

TOTP (RFC 6238) is HOTP with a counter made from time: the Unix time in seconds, divided by the period and rounded down. A new code starts at each period, so both sides need an accurate clock.

TOTP = HOTP(key, floor(unix time / period));   HOTP = truncate(HMAC(key, counter)) mod 10^digits

Secrets and otpauth:// URIs

The secret is a Base32 text (RFC 4648): the letters A to Z and the digits 2 to 7. Spaces are ignored and the padding can be left off. A secret with a character outside that set, or with an impossible length, is refused.

An otpauth:// URI (Google's Key URI Format) holds the type, the label, the secret, and the optional issuer, algorithm, digits, period and counter. Missing settings take the format's defaults: SHA1, 6 digits, 30 seconds and counter 0.

How the page was checked

The code is tested against the test values of RFC 4226 Appendix D (counts 0 to 9) and RFC 6238 Appendix B (six times, for SHA-1, SHA-256 and SHA-512 with eight digits). The HMAC is computed by your browser's SubtleCrypto.

Worked example: the RFC 6238 test secret

The RFC test secret is the text 12345678901234567890, which in Base32 is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ. At Unix time 59, with a 30-second period, step 1 of TOTP gives the eight-digit code 94287082 for SHA-1.

With six digits the same step gives 287082, the code of RFC 4226 counter 1; the last six digits of the eight-digit value.

Frequently asked questions

Is the secret or the code sent to a server?

No. The code is computed in your browser, and the page makes no request that contains the secret or the code. Nothing is stored, and a reload forgets both.

Should I paste my real account's secret here?

Only on a page you trust, and only if no one else can see your screen. Your authenticator app is the normal place for a real account, because it keeps the secret for daily use; this page suits your own tools and codes you need once.

Why does the code change every 30 seconds?

A time-based code (TOTP) uses the number of periods since the Unix epoch, so a new code starts at each period. The countdown shows how long the current one lasts.

Why does my code not match the service's app?

Check the secret (Base32 only), the hash, the digits and the period, which the service names; then check that the clock of your device is right, because a time-based code depends on it. The previous and next codes help to see a small clock difference.

Which hash should I choose?

Choose the one the service states. SHA-1 is the default of the RFC 4226 HOTP and of the otpauth format; RFC 6238 allows SHA-256 and SHA-512 for TOTP as well.

What is the difference between TOTP and HOTP?

TOTP uses the time, so the code changes with each period. HOTP uses a counter that moves on each use, so the code stays the same until the counter changes.

What does the otpauth:// text do?

It carries the settings of a two-factor key in the Key URI Format, usually inside a QR code. Pasting it here fills in the secret, the hash, the digits, the period and the counter.

Sources

Figures and text last checked on Tuesday, November 10, 2026.