TOTP Generator
Generate secure time-based one-time passwords (TOTP) locally in your browser for enhanced 2FA security. Supports RFC 6238, custom algorithms, and URI imports.
Updated
What is the TOTP Generator?
Welcome to the TOTP Generator, your secure and convenient online tool for generating Time-based One-Time Passwords (TOTP) directly within your browser. Designed for enhanced security and privacy, this tool allows you to create 2FA (Two-Factor Authentication) codes without relying on external servers or mobile applications.
With support for RFC 6238, various hashing algorithms (SHA-1, SHA-256, SHA-512), and easy otpauth:// URI parsing, managing your digital security has never been simpler. Whether you need to generate a quick code from a secret key or import an entire account configuration, our TOTP Generator provides a robust and user-friendly solution, keeping your sensitive data local and under your control.
How it works
The Time-based One-Time Password (TOTP) Generator operates on a well-established cryptographic algorithm defined in RFC 6238. It combines a shared secret key with the current time to produce a unique, temporary password. Here's a breakdown of the process:
1. The Shared Secret Key
At the heart of TOTP is a secret key, typically provided by a service when you enable 2FA. This key is usually presented as a QR code or a Base32 encoded string. Both the service and this generator possess this identical secret key. It's crucial to keep this key confidential, as anyone with access to it can generate your OTPs.
2. The Time Factor
Unlike traditional passwords, TOTP incorporates the current time as a critical component. The time is divided into fixed intervals, usually 30 or 60 seconds. This generator and the authenticating service both calculate a time-step value based on the current time, ensuring they are synchronized.
3. HMAC Algorithm
The secret key and the time-step value are fed into a Hash-based Message Authentication Code (HMAC) algorithm. This cryptographic function generates a unique hash. The generator supports various HMAC algorithms, including SHA-1, SHA-256, and SHA-512, providing flexibility and enhanced security options.
4. Truncation and Formatting
The resulting HMAC hash is then truncated to a shorter, fixed-length numeric code (typically 6 or 8 digits). This truncation process involves selecting a specific portion of the hash and converting it into a decimal number. Finally, the code is formatted for readability, often with a space in the middle.
5. Local Generation and Privacy
Crucially, this TOTP Generator performs all these calculations locally within your browser. Your secret keys and generated codes never leave your device, ensuring maximum privacy and security. The tool does not send any sensitive information to external servers. For convenience, you can save your accounts in your browser's local storage, which remains on your device and is not transmitted elsewhere.
HOTP (Counter-based One-Time Password)
In addition to TOTP, the generator also supports HOTP (RFC 4226), which is a counter-based mechanism. Instead of time, HOTP uses a moving counter. Each time a new code is requested, the counter increments. Both the client and the server must keep their counters synchronized. This is less common for general 2FA but is supported for specific use cases.
Examples
Generate a TOTP code from a secret key
Input a Base32 secret key to instantly generate a 6-digit time-based one-time password.
Import a TOTP account using an otpauth URI
Paste an otpauth:// URI to automatically configure and save a new 2FA account.
Generate an HOTP code with a custom counter
For counter-based OTPs, manually increment the counter to generate the next valid code.
Frequently asked questions
What is TOTP?
What is TOTP?
TOTP stands for Time-based One-Time Password. It's a type of two-factor authentication (2FA) that generates a unique, temporary password that is valid for a short period (usually 30 or 60 seconds). This password is created using a shared secret key and the current time, making it highly secure as it changes constantly.
How does this TOTP Generator ensure my security and privacy?
How does this TOTP Generator ensure my security and privacy?
This TOTP Generator prioritizes your security and privacy by performing all calculations locally within your browser. Your secret keys and generated codes never leave your device and are not transmitted to any external servers. If you choose to save accounts, they are stored in your browser's localStorage, which also remains on your device.
What is an otpauth:// URI and how do I use it?
What is an otpauth:// URI and how do I use it?
An otpauth:// URI is a standardized format for encoding TOTP or HOTP account details, often presented as a QR code. You can typically scan these QR codes with an authenticator app or copy the URI string directly. This generator can parse these URIs to automatically configure your 2FA account, simplifying the setup process.
Can I use this generator offline?
Can I use this generator offline?
Yes, once the page is loaded, this TOTP Generator can function entirely offline. All necessary cryptographic calculations are performed client-side using your browser's Web Crypto API, meaning you don't need an active internet connection to generate codes after the initial page load.
What is the difference between TOTP and HOTP?
What is the difference between TOTP and HOTP?
TOTP (Time-based One-Time Password) uses the current time as a moving factor to generate codes, which expire after a short period. HOTP (HMAC-based One-Time Password) uses a counter that increments with each new code generation. While TOTP is more common for general 2FA, HOTP is used in specific scenarios where a time-based mechanism might be impractical.
Why are there different algorithms like SHA-1, SHA-256, and SHA-512?
Why are there different algorithms like SHA-1, SHA-256, and SHA-512?
These refer to the cryptographic hash functions used within the HMAC algorithm. SHA-1 is the original standard for TOTP, but SHA-256 and SHA-512 offer stronger cryptographic security. This generator supports all three, allowing you to choose the algorithm specified by your service provider or opt for a more secure one if available.
What happens if my device's clock is out of sync?
What happens if my device's clock is out of sync?
TOTP relies on time synchronization between your device and the authenticating service. If your device's clock is significantly out of sync (typically by more than 30-60 seconds), the generated codes may not be accepted. Most authenticator apps and operating systems offer options to automatically synchronize your clock to prevent this issue. This tool also provides a visual countdown to help you monitor the current time window.
How do I add or remove accounts?
How do I add or remove accounts?
You can add accounts by manually entering the secret key and other parameters, or by pasting an otpauth:// URI. Once a code is generated, you'll see an option to save the account. Saved accounts appear in the sidebar, and you can delete them individually using the trash icon next to each entry. Remember, saved accounts are stored only in your browser's local storage.
Related tools
More utilities you might find handy.
API Key Generator
Generate cryptographically secure API keys, tokens, and secrets in your browser. Hex, Base62, Base64URL, UUID, custom charset, prefixes, and bulk export.
Bcrypt Hash Generator
Generate and inspect bcrypt password hashes locally in your browser.
CRC32 Generator
Instantly generate CRC32, CRC32C, BZIP2, MPEG-2 and other checksums for text, files, hex or Base64 – 100% client-side.