Free · Private · Client-side
TOTP Generator
Create a Base32 secret, scan the QR code or copy the otpauth URI, and read the current 6-digit code. Works with Google Authenticator, Authy, and other RFC 6238 apps. The secret never leaves this browser.
Generated values never leave this device.20 bytes (160 bits) encoded as Base32. Store securely - this is your master secret.
TOTP (RFC 6238) derives a 6-digit code from the secret and the current 30-second time window — codes expire and regenerate every 30 seconds, and both sides compute them locally from the shared secret.
Current TOTP code
otpauth URI
The URI contains the secret. The QR code is drawn from it in this browser — it is not sent to a QR service.
QR code
Scan with Google Authenticator, Authy, or any RFC 6238 app.
TOTP secret
Generate a fresh Base32 setup key.
Authenticator setup
Build a scannable otpauth QR for a new account.
Backup codes
One-time recovery codes for when the authenticator is gone.
HMAC key
TOTP is HMAC-SHA1 of the time counter. Generate HMAC secrets here.
Base32 encoder
Encode or decode the alphabet TOTP secrets use.
Recovery key
Longer account recovery keys, separate from rotating codes.
Setup Instructions
Google Authenticator
- Open Google Authenticator app
- Tap the + icon
- Select "Enter a setup key"
- Paste the Base32 secret above
- Verify the 6-digit code matches
Authy
- Open Authy app
- Tap the + icon
- Choose manual entry
- Paste the Base32 secret above
- Enter account details if prompted
Manual Setup
- Choose "Enter a setup key" option
- Copy the Base32 secret above
- Paste into your authenticator
- Set time-based (TOTP)
- Use 6 digits, 30-second interval
Alternative Apps
- Microsoft Authenticator
- 1Password
- Bitwarden
- LastPass Authenticator
- FreeOTP
Security Best Practices
- Backup your secret - Store the Base32 secret in a secure location
- Use strong secrets - Generate random 160-bit (20-byte) secrets
- Secure transmission - Share QR codes/secrets over secure channels only
- Multiple devices - Consider setting up multiple authenticator devices
- Recovery codes - Always generate backup/recovery codes for your accounts
Implementation Examples
const crypto = require('crypto');
function generateTOTP(secret, window = 30) {
const counter = Math.floor(Date.now() / 1000 / window);
const buffer = Buffer.alloc(8);
buffer.writeUInt32BE(counter, 4);
const hmac = crypto.createHmac('sha1', Buffer.from(secret, 'base32'));
hmac.update(buffer);
const hash = hmac.digest();
const offset = hash[19] & 0xf;
const code = (
((hash[offset] & 0x7f) << 24) |
((hash[offset + 1] & 0xff) << 16) |
((hash[offset + 2] & 0xff) << 8) |
(hash[offset + 3] & 0xff)
) % 1000000;
return code.toString().padStart(6, '0');
}
// Usage
const secret = 'YOUR_BASE32_SECRET';
const code = generateTOTP(secret);
console.log('TOTP Code:', code);import hmac
import hashlib
import struct
import time
import base64
def generate_totp(secret, window=30):
# Decode base32 secret
key = base64.b32decode(secret.upper() + '=' * (-len(secret) % 8))
# Current time window
counter = int(time.time() // window)
# Generate HOTP
counter_bytes = struct.pack('>Q', counter)
hmac_digest = hmac.new(key, counter_bytes, hashlib.sha1).digest()
# Dynamic truncation
offset = hmac_digest[-1] & 0xf
code = struct.unpack('>I', hmac_digest[offset:offset+4])[0]
code = (code & 0x7fffffff) % 1000000
return f'{code:06d}'
# Usage
secret = 'YOUR_BASE32_SECRET'
code = generate_totp(secret)
print(f'TOTP Code: {code}')Testing & Validation
Frequently asked questions
What is a TOTP generator?
A TOTP generator turns a shared Base32 secret and the current time into a 6-digit code, using the HMAC-SHA1 construction in RFC 6238. The code changes every 30 seconds. Your authenticator app and this page both compute it locally from the same secret, so the code does not have to be fetched from a server.
Does this TOTP generator work with Google Authenticator?
Yes. Google Authenticator accepts the otpauth URI and the QR code on this page, or the Base32 secret entered by hand. Use 6 digits and a 30-second period, which are the defaults this page writes into the URI. The code shown here should match the app for the same secret while both clocks are in sync.
Does this work with Authy?
Yes. Authy, Microsoft Authenticator, 1Password, Bitwarden, and any other app that implements RFC 6238 can enroll this secret. In Authy, add an account, choose manual entry, and paste the Base32 secret, or scan the QR code. Authy backups are a separate feature of that app — they do not change the secret this page generated.
How should I back up the TOTP secret?
Save the Base32 secret, or the otpauth URI, in a password manager or other offline store before you depend on the account. The QR code is just that same secret drawn as an image, so a photo of it is also a copy of the key. Also generate one-time backup codes for the account and store them separately. If the only copy of the secret is a single phone, losing the phone locks you out.
Why is the code rejected when the clocks are slightly off?
TOTP divides Unix time by 30 seconds and HMACs that counter. If the phone or the server is ahead or behind by more than one window, the codes will not match. Allow about 30 seconds of skew (one step either side) when you verify, and turn on automatic time sync. A code that is off by several minutes is a clock problem, not a bad secret.
Does the secret leave my browser?
No. The secret, the 6-digit code, the otpauth URI, and the QR code are computed in your browser with the Web Crypto API. This page does not send them to RandomKeygen or to an external QR service. Treat the page like any other place you paste a secret: use a device you trust, and do not leave the secret on a shared screen.