RandomKeygen

TOTP Generator

Generate Time-based One-Time Passwords (TOTP) for two-factor authentication. Compatible with Google Authenticator, Authy, and other 2FA apps.

Secret Key

20 bytes (160 bits) encoded as Base32. Store securely - this is your master secret.

Current TOTP Code

Refreshes in 30s
••••••

Setup in Authenticator App

Scan with authenticator app:

Setup Instructions

📱 Google Authenticator

  1. Open Google Authenticator app
  2. Tap the + icon
  3. Select "Scan a QR code"
  4. Scan the QR code above
  5. Verify the 6-digit code matches

🔐 Authy

  1. Open Authy app
  2. Tap the + icon
  3. Select "Scan QR Code"
  4. Scan the QR code above
  5. Enter account details if prompted

💻 Manual Setup

  1. Choose "Enter a setup key" option
  2. Copy the Base32 secret above
  3. Paste into your authenticator
  4. Set time-based (TOTP)
  5. Use 6 digits, 30-second interval

🔄 Alternative Apps

  • Microsoft Authenticator
  • 1Password
  • Bitwarden
  • LastPass Authenticator
  • FreeOTP

Security Best Practices

  • Backup your secret - Store the Base32 secret in a secure location
  • Use strong secrets - Generate random 160-bit (20-byte) secrets
  • Secure transmission - Share QR codes/secrets over secure channels only
  • Multiple devices - Consider setting up multiple authenticator devices
  • Recovery codes - Always generate backup/recovery codes for your accounts

Implementation Examples

JavaScript/Node.js
const crypto = require('crypto');

function generateTOTP(secret, window = 30) {
  const counter = Math.floor(Date.now() / 1000 / window);
  const buffer = Buffer.alloc(8);
  buffer.writeUInt32BE(counter, 4);
  
  const hmac = crypto.createHmac('sha1', Buffer.from(secret, 'base32'));
  hmac.update(buffer);
  const hash = hmac.digest();
  
  const offset = hash[19] & 0xf;
  const code = (
    ((hash[offset] & 0x7f) << 24) |
    ((hash[offset + 1] & 0xff) << 16) |
    ((hash[offset + 2] & 0xff) << 8) |
    (hash[offset + 3] & 0xff)
  ) % 1000000;
  
  return code.toString().padStart(6, '0');
}

// Usage
const secret = '';
const code = generateTOTP(secret);
console.log('TOTP Code:', code);
Python
import hmac
import hashlib
import struct
import time
import base64

def generate_totp(secret, window=30):
    # Decode base32 secret
    key = base64.b32decode(secret.upper() + '=' * (-len(secret) % 8))
    
    # Current time window
    counter = int(time.time() // window)
    
    # Generate HOTP
    counter_bytes = struct.pack('>Q', counter)
    hmac_digest = hmac.new(key, counter_bytes, hashlib.sha1).digest()
    
    # Dynamic truncation
    offset = hmac_digest[-1] & 0xf
    code = struct.unpack('>I', hmac_digest[offset:offset+4])[0]
    code = (code & 0x7fffffff) % 1000000
    
    return f'{code:06d}'

# Usage
secret = ''
code = generate_totp(secret)
print(f'TOTP Code: {code}')

Testing & Validation

✓Verify codes match between this tool and your authenticator app
✓Test with a known reference implementation (RFC 6238)
✓Check time synchronization between devices
iTOTP codes refresh every 30 seconds
iAllow ±1 time window for network delays and clock skew