Generator/TOTP generator

TOTP generator

Paste a Base32 secret or an otpauth:// link and read the code. Every parameter RFC 6238 allows is adjustable — SHA-1, SHA-256 or SHA-512, six or eight digits, any time step — which is the difference between this and an authenticator app that assumes the defaults and gives you no way to say otherwise.

or drop an image here

Advanced
Digits
Period
Algorithm
Your code appears herepaste a key above, upload its QR image, or scan one

The four parameters, and when they matter

A TOTP secret on its own is not enough to produce a code. Three more values decide what comes out, and services rarely mention them because the defaults are nearly universal — until they are not.

SecretBase32 — A–Z and 2–7. Case, spaces and dashes are ignored, and trailing = padding is optional. Anything outside that alphabet is a transcription error rather than a key.
Digits6 almost everywhere, 8 on some enterprise and banking deployments. A leading zero is part of the code; dropping it is a rejection.
Period30 seconds by default. 60 appears occasionally. The period sets how the time is divided into steps, so a mismatch produces codes that are wrong most of the time and right by coincidence.
AlgorithmSHA-1 by default, SHA-256 and SHA-512 permitted. Most apps ignore the algorithm field in an otpauth:// link entirely, which is why SHA-512 services like Kraken break them.
The one that bites

If a generator produces the wrong code from a key you are certain of, work through the list in this order: device clock, then algorithm, then period, then digits. The clock explains most of it; Kraken’s SHA-512 secrets explain most of the rest.

Importing an otpauth:// link instead

The QR code a service shows at enrollment encodes a URI, and that URI carries the parameters along with the secret:

otpauth://totp/Kraken:[email protected]?secret=JBSWY3DP…&issuer=Kraken&algorithm=SHA512&digits=6&period=30

Paste that whole string rather than picking the secret out of it and the label, issuer, algorithm, digits and period are all set from the link — no guessing, and no silent default overriding what the service actually issued. Uploading or scanning the QR image does the same thing, since the image contains nothing but this text.

Checking a generator before you trust it

RFC 6238 publishes test vectors precisely so that implementations can be verified rather than believed. The secret is the ASCII string 12345678901234567890, which is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ in Base32. Set digits to 8, algorithm to SHA-1, period to 30, and a correct generator produces 94287082 at Unix time 59 and 89005924 at 1234567890.

The full table, including the SHA-256 and SHA-512 rows and the longer secrets they require, is on the TOTP explainer.

When a key will not load

  • Characters outside A–Z and 2–7. Base32 has no 0, 1 or 8. A key containing them was mistyped or copied from something that was not a key.
  • A secret pasted from a screenshot. O/0 and I/1 confusion is the usual culprit. Upload the QR image instead — it carries the exact bytes.
  • A hex secret. Some enterprise systems issue hex rather than Base32. It has to be converted before any standard authenticator will take it.
  • A key that loads but gives rejected codes. Then the key is fine and something else is wrong — the rejected-code guide works through it in order.

What this is not

It is not a vault. Clearing site data, using another browser or switching machines loses whatever you saved, and anything saved here is stored in readable form. Keep an authenticator app enrolled and keep the recovery codes the service issued — the comparison pages are blunt about which tool wins where.

What a browser generator is good at is the moment the app is not available: a laptop with the phone in another room, a dead battery, a device being repaired, or a key you have just been given and want to check before committing to it.

Questions

What is a TOTP generator?
Software that turns a shared secret and the current time into the one-time code a service asks for at login. An authenticator app is a TOTP generator with a vault attached; this page is the same computation without the vault, running in the tab.
Will the codes match Google Authenticator?
Yes, for the same secret and the same parameters. TOTP has no registration step, so every conforming implementation produces identical digits at the same moment. If two generators disagree, the cause is a parameter mismatch or a clock, not the key.
Is it safe to paste a secret into a web page?
It depends entirely on the page, which is why it is worth being specific about this one: there is no backend to send a key to, the Content-Security-Policy blocks requests to anywhere but this origin and Google Analytics, and the whole site is static files. What that does not remove is the machine itself — a shared or compromised computer is a bad place to hold a key, whatever the page promises.
Can it generate 8-digit codes or a 60-second period?
Yes. Open Advanced and set digits, period and algorithm independently. Both are legal RFC 6238 parameters that a handful of services use, and an otpauth:// link carries them so that importing one sets them for you.
Which algorithm should I choose?
SHA-1 unless the service says otherwise — it is the default almost everywhere, and its collision weaknesses do not apply to HMAC. Kraken is the notable exception, issuing SHA-512 secrets that produce wrong codes in any generator locked to SHA-1.
Does it work offline?
Once the page has loaded, yes. Generating a code makes no network request — the maths runs against your device clock. Only the analytics tag wants the network, and it plays no part in producing a code.
Can I check it against the RFC test vectors?
Yes, and it is a reasonable thing to do before trusting any generator. Use the Base32 secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ with 8 digits and SHA-1: at Unix time 59 the code is 94287082, and at 1234567890 it is 89005924.

Next

ExplainerHow TOTP derives the digitsToolTest a key and your clockSetup guidesFind your service's setup key