TOTP Generator

TOTP stands for Time-based One-Time Password. It uses a shared secret and a time-step to produce a code that changes periodically. The service and authenticator must use matching settings and reasonably synchronized clocks.

Calculations run in your browser, and saved accounts are stored in its localStorage. Local storage is not encrypted by this tool; someone with access to the same browser profile may be able to read saved secrets. Avoid saving secrets on shared or untrusted devices.

An otpauth:// URI is a standardized format for encoding TOTP or HOTP account details, often presented as a QR code. You can typically scan these QR codes with an authenticator app or copy the URI string directly. This generator can parse these URIs to automatically configure your 2FA account, simplifying the setup process.

Yes, once the page is loaded, this TOTP Generator can function entirely offline. All necessary cryptographic calculations are performed client-side using your browser's Web Crypto API, meaning you don't need an active internet connection to generate codes after the initial page load.

TOTP (Time-based One-Time Password) uses the current time as a moving factor to generate codes, which expire after a short period. HOTP (HMAC-based One-Time Password) uses a counter. In this tool, you advance that counter manually; the service and generator must remain synchronized.

These are hash functions used by HMAC. The service and generator must use the same algorithm, so select the one specified by the service rather than changing it independently.

TOTP relies on time synchronization between your device and the authenticating service. If your device's clock is significantly out of sync (typically by more than 30-60 seconds), the generated codes may not be accepted. Most authenticator apps and operating systems offer options to automatically synchronize your clock to prevent this issue. This tool also provides a visual countdown to help you monitor the current time window.

You can add accounts by manually entering the secret key and other parameters, or by pasting an otpauth:// URI. Once a code is generated, you'll see an option to save the account. Saved accounts appear in the sidebar, and you can delete them individually using the trash icon next to each entry. Saved accounts are stored in this browser's local storage, which is not encrypted by the tool.