TOTP Generator Online
Generate TOTP secrets and time-based one-time passwords for 2FA authentication. Scan the QR code with Google Authenticator, Authy, or any TOTP app.
NKDMGVEPHFVYLQ77CXJ2VMBNVN3QRSGO238633otpauth://totp/MyApp:user%40example.com?issuer=MyApp&secret=NKDMGVEPHFVYLQ77CXJ2VMBNVN3QRSGO&algorithm=SHA1&digits=6&period=30Use this URI to provision the secret in authenticator apps (scan as QR code or enter manually).
Scan with Google Authenticator, Authy, or any TOTP app
When a TOTP generator is the right tool
Use this page to create a test TOTP secret, watch the current 6-digit code, and provision an authenticator app from a QR code or otpauth:// URI. It is a local generator, not a place to recover an existing token — you cannot paste a secret you already have.
Use cases
Trying an authenticator app
Leave or edit Issuer and Account, scan the QR, and confirm the app’s digits match the code on this page (they share the same 30-second windows). New Secret starts over.
Copying the URI by hand
If you cannot scan, copy the URI. It includes the issuer, account, secret, and the fixed algorithm parameters.
How codes are generated
A timer refreshes the code and the remaining seconds every second, using the displayed Base32 secret. Issuer and account only affect the URI and QR. Copy buttons are provided for the secret, the code, and the URI.
otpauth://totp/MyApp:user%40example.com?issuer=MyApp&secret=…&algorithm=SHA1&digits=6&period=30What this tool does not do
It does not implement SHA-256 or SHA-512 TOTP, 8-digit codes, or a custom period, and it does not import an existing secret. For a generic QR of other text, use QR Code Generator. Work stays in your browser.
How to use TOTP Generator
- Optionally set Issuer and Account, or click New Secret for a different key.
- Scan the QR with an authenticator app, or copy the URI or the Base32 secret.
- Compare the live 6-digit code and countdown if you need to confirm the app is in sync.
Frequently asked questions
How does TOTP Generator work?
On load, the page creates a 20-byte random secret and shows it as Base32. Every second it derives a 6-digit TOTP with a 30-second period and SHA-1 (the otpauth library defaults). Issuer (default MyApp) and account (default user@example.com) are included in the otpauth:// URI and QR code only — they do not change the digits. New Secret replaces the key. There is no field to paste an existing secret.
Can I change the algorithm, digits, or period?
No. Those values are fixed: SHA-1, 6 digits, 30 seconds. The URI includes algorithm=SHA1&digits=6&period=30. The countdown ring turns red when five seconds or fewer remain. If the secret is not valid Base32, the code shows ------.
What does the QR code contain?
A 200-pixel QR code (black on white, margin 2) of the otpauth URI, drawn in your browser with the qrcode library. Scan it with an authenticator app, or copy the URI. The issuer and account labels update the URI and QR as you type.
Is my secret uploaded? Is this safe for a production account?
Generation and coding run in your browser; nothing is sent to a server. The secret is still visible on the page, in the QR, and in anything you copy. Treat this as a local demo. Do not use a secret displayed here as the second factor for a real production account if you would not want that value sitting on screen or in a screenshot.