Generate and validate time-based (TOTP) and counter-based (HOTP) one-time passwords locally.
Loading tool
About OTP code generator
Generates and validates one-time passwords from a Base32 secret, either time-based (TOTP, RFC 6238) or counter-based (HOTP, RFC 4226). You can set 6, 7 or 8 digits, SHA-1, SHA-256 or SHA-512, and the TOTP period or HOTP counter. It shows the previous, current and next codes, a countdown, the otpauth:// URI and a QR code for authenticator apps. Codes are computed in your browser, so the secret is not sent anywhere.
Common uses
- Test a 2FA implementation against known codes
- Check that a server accepts codes from the previous or next time step
- Create an otpauth:// QR code for a test account
- Debug why an authenticator app's codes are rejected
FAQ
- What is the difference between TOTP and HOTP?
- HOTP derives each code from an incrementing counter, while TOTP uses the current time divided into steps (usually 30 seconds) as the counter.
- Why are my TOTP codes wrong?
- The most common cause is clock drift between the device and the server. Other causes are a different algorithm, digit count or period than the authenticator app expects.
- What format is the TOTP secret in?
- Secrets are usually shared as Base32 strings (letters A-Z and digits 2-7), which is also the format used in otpauth:// URIs and QR codes.
- Do authenticator apps support SHA-256 and 8 digits?
- Support varies. Many apps, including Google Authenticator, reliably support only SHA-1, 6 digits and a 30-second period, so these defaults are the safest choice.