Generate time-based one-time passwords (TOTP tokens) for two-factor authentication right in your browser. SHA-1, SHA-256 and SHA-512, 6 or 8 digits, live 30-second countdown, a code validator, and otpauth:// import/export. No signup, no app install — and your secret key never leaves your device.
A note on QR codes (qrcode): many people search for a "TOTP QR code generator". This tool deliberately does not render QR images — QR libraries would require external code, and this page's guarantee is zero third-party requests. Instead, copy the otpauth:// URL above into any authenticator app's manual-entry/URI-import feature, or paste it into a QR encoder you already trust to print a backup.
TOTP (RFC 6238) turns your secret key and the current time into a short numeric code. Both your authenticator app and the server run the same math: counter = floor(unix_time / 30), then HMAC-SHA(secret, counter), then dynamic truncation picks 4 bytes and reduces them modulo 10^digits. Because time moves forward, the code changes every 30 seconds — and anyone with the same secret and an accurate clock gets the same code.
Google / Gmail: myaccount.google.com → Security → 2-Step Verification → Authenticator app → scan the QR or use "Can't scan it?" to reveal the text secret, then paste it here.
GitHub: Settings → Password and authentication → Enable two-factor authentication → "Setup key" reveals the base32 secret (TOTP, SHA-1, 6 digits).
Amazon AWS: IAM → Security credentials → Assign MFA → Authenticator app; AWS shows the secret for manual entry.
Microsoft: mysign-ins → Security info → Add method → Authenticator app → "Can't scan image?" shows the secret.
Discord / Steam / banks: most follow the same pattern — look for "manual entry key" or "setup key" next to the QR code during 2FA setup.
| Tool | 100% client-side | RFC 6238 vectors verified | Multi-algorithm | Validator | otpauth import | Guides / FAQ |
|---|---|---|---|---|---|---|
| This tool (nrtechstudio.com) | Yes | Yes — all Appendix B vectors | SHA-1 / 256 / 512 | Yes | Yes | Yes |
| totp.app | Yes | Not published | SHA-1 / 256 / 512 | No | QR scan | Minimal |
| testmuai.com | Partial | Not published | Yes | No | QR | Minimal |
| sen-ltd/totp-generator (GitHub) | Yes | Not published | Yes | No | Yes | Minimal |
| 2fa-viewer (GitHub) | Yes | Not published | SHA-1 | No | No | Minimal |
Comparison based on publicly visible features as of October 2026; tools evolve — verify on their current pages. "Not published" means the project does not document RFC vector testing, not that it necessarily fails it.
Secret: base32-encoded random bytes (RFC 4648). 16+ characters recommended; case-insensitive, spaces ignored.
Algorithm: HMAC hash. SHA-1 is the universal default; SHA-256/512 for enterprise systems. Must match the server.
Digits: 6 (consumer standard) or 8 (banking/enterprise). Derived as code mod 10^digits.
Period: almost always 30 seconds. Some systems use 60.
Counter: floor(unix_time / period). Seconds 0–29 → counter N; seconds 30–59 → counter N+1. A one-second difference at the boundary produces a completely different code.
Clock skew: servers usually accept ±1 window. If codes always fail, enable automatic time sync on your device first.
A TOTP generator creates time-based one-time passwords — the 6- or 8-digit codes used for two-factor authentication (2FA). It combines your secret key with the current time using HMAC (RFC 6238), producing a new code every 30 seconds that matches what your authenticator app generates.
Paste your base32 secret key into the Generator tab above, choose the algorithm (usually SHA-1) and digit count, and the current code appears instantly with a live countdown. The code refreshes automatically every period — no signup, no server.
It depends on the tool. This generator runs 100% client-side: your secret is processed by JavaScript in your own browser and is never sent anywhere — you can verify this in your browser's DevTools network tab. Never paste a real secret into a tool that uploads it to a server. For maximum safety, prefer a dedicated authenticator app for daily use and treat web generators as backup or migration helpers.
When you enable 2FA on a service (Google, GitHub, AWS, etc.), the setup screen shows a QR code plus a text secret — usually labeled "secret key", "setup key", or "manual entry key". It looks like JBSWY3DPEHPK3PXP (base32). If you already use an authenticator app, most apps let you export or view the secret per account.
Use whatever the service expects — the vast majority use SHA-1 (the RFC 6238 default). SHA-256 and SHA-512 are supported by some enterprise systems and are technically stronger, but the algorithm must match on both sides or codes will not validate. When in doubt, SHA-1 with 6 digits and a 30-second period is the universal default.
The #1 cause is clock drift: TOTP depends on accurate time, so if your device clock is off by more than ~30 seconds the codes won't match. Enable automatic time sync. Other causes: wrong secret (check for typos or missing characters), wrong algorithm (SHA-1 vs SHA-256), or wrong digit count (6 vs 8). Use the Validator tab here to test a code against your secret.
RFC 6238 computes an 8-digit code and truncates to 6 digits for the common case. 6 digits (1 million combinations) is the standard for consumer 2FA and is plenty given the 30-second window. 8-digit codes (100 million combinations) are used by some banking and enterprise systems. Both come from the same HMAC computation.
otpauth://totp/Issuer:account?secret=BASE32&issuer=Issuer&algorithm=SHA1&digits=6&period=30 is the standard provisioning URI. Authenticator apps scan it from a QR code; the parameters after ? define the secret, algorithm, digit count, and period. This tool can parse such URLs (Import tab) and generate them (Export) for backup or migration.
The reliable path: export each account's secret from your old app (Google Authenticator's export shows QR codes), parse each otpauth:// URL with this tool's Import tab to recover the parameters, then add them to the new app via manual entry or a freshly generated QR. Keep the old app until every account is confirmed working in the new one.
TOTP and HOTP (both authenticator-app codes) are far more secure than SMS, which is vulnerable to SIM-swap attacks. Between the two, TOTP (time-based, codes expire in 30 seconds) is the modern standard; HOTP (counter-based) stays valid until used, so a stolen HOTP code has a longer attack window. Prefer TOTP wherever offered.
Yes. The entire tool is a single HTML file with zero network requests — once the page has loaded, you can disconnect from the internet and keep generating and validating codes. TOTP needs only your secret and the current time, both available locally.
Yes — it runs in any modern browser on any platform: iPhone (iOS Safari), Android (Chrome), Windows, macOS, and Linux desktops, in Chrome, Firefox, Edge, or Safari — no browser extension needed and nothing to download or install. For everyday use, a native authenticator app is more convenient; this web tool is ideal for validation, migration, and development.
Most web TOTP tools are minimal demos with no verifiable correctness. This one is tested against all RFC 6238 Appendix B test vectors (SHA-1, SHA-256, SHA-512), adds a code validator, otpauth:// import/export, and full guides — and publishes its verification method. Feature sets change over time, so compare current pages before choosing.
TOTP divides time into 30-second counters: seconds 0–29 use counter N, seconds 30–59 use counter N+1. A code generated at second 29 and one at second 30 are completely different. Servers typically accept the current, previous, and next window to tolerate small clock differences — the Validator tab here checks all three.
Yes — the Validator tab checks a code against your secret for the current, previous, and next 30-second window and tells you which window matched (or that none did). It's useful when debugging "invalid code" errors or testing your own TOTP implementation.
Free tool by NRTechStudio
Explore similar security tools and calculators. 100% free, accurate, and runs completely in your browser without sign-up.
2 taps, no typing needed — diagnostics are sent automatically.