Time-based one-time passwords with 6 or 8 digits and a choice of algorithm
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.This generates time-based one-time passwords to RFC 6238, the kind banks, VPNs and admin panels ask for. Pick a 30 or 60 second window, six or eight digits and SHA-1, SHA-256 or SHA-512, generate a new random secret or paste one, and scan the QR code into an authenticator to compare its codes with the page. SMS codes are a different system and are not covered.
Choose SHA-1, SHA-256 or SHA-512, 6 or 8 digits, and a 30 s or 60 s period.
Press New secret for a random Base32 key, or paste the key you already have.
Fill in Issuer and Account so the entry is named in the authenticator app.
Scan the QR code with your authenticator app, or copy the otpauth link.
Compare the app with the Current code on the page, since many apps ignore non-default settings.
This TOTP generator shows the live one-time code for a secret, with a ring counting down to the next code and the previous and next codes beside it. It builds the otpauth link and QR code that Google Authenticator, Microsoft Authenticator, Authy and password managers scan, and it tests whether a code you type is valid right now.
Codes follow RFC 6238 with a 30 or 60 second period, 6 or 8 digits and SHA-1, SHA-256 or SHA-512. Most apps only support the default of SHA-1, six digits and 30 seconds, so change those only if your server expects it. The tester allows a chosen drift of zero, one or two steps either side and tells you which step matched.
Everything runs in your browser with the Web Crypto API and the page's own clock, so the codes are only as right as your device time. Secrets are never sent, logged or saved; only your period, digits and algorithm are remembered. The QR code is drawn on the page and not fetched from any service.
The rest of the article, and all 6 questions about TOTP Generator and Tester, are on the TOTP Generator and Tester page.
Paste the Base32 secret, the string of letters A to Z and digits 2 to 7 a site shows under its QR code, into the Secret box. The current code appears straight away with a countdown. Spaces and lower case are fine. If you have an otpauth:// link instead, paste that and the settings are filled in from it.
The most common cause is clock drift: codes depend on the time, so a phone or server a minute off produces codes the other side does not expect. Use the tester to see whether the code matches the previous or next window. Other causes are a mistyped secret or an algorithm, digit count or period that differs from the server.
Many do not. Google Authenticator historically ignored those settings and used SHA-1, six digits and 30 seconds regardless, which gives wrong codes. Microsoft Authenticator, Authy and most password managers vary. Use the defaults unless you control both sides, and scan the QR code here to check your app's codes match.
HOTP (RFC 4226) makes a new code each time a counter goes up, usually when a button is pressed. TOTP (RFC 6238) replaces the counter with the current time divided into 30 or 60 second steps, so codes expire on their own. Almost all authenticator apps use TOTP; this tool generates and tests TOTP only.
Still stuck? Ask about TOTP Generator and Tester and anybody who knows can answer. No account needed.
Same job, other tools: Passphrase Generator – Three to ten random words you can actually remember · HMAC-SHA256 Generator – Compute an HMAC-SHA256 signature in hex and Base64 · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.
On the related tools: CSP Validator – Find typos, missing semicolons and invalid sources in a Content-Security-Policy.
In the collection Security Tools for Developers.