Free online TOTP generator with SHA-1/256/512, otpauth URI import/export, and countdown. Secrets stay in your browser.
TL;DR: Free online TOTP generator following RFC 6238, supporting SHA-1/SHA-256/SHA-512, 6/8 digit codes, 30/60 second steps, and otpauth URI import/export. Secrets are stored only in your browser.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Usage Guide
TOTP (time-based one-time password) is the rotating code you type during two-factor login: derived from "secret + current time", typically every 30 seconds. This tool generates codes locally with SHA-1/SHA-256/SHA-512, 6/8 digits, 30/60s steps, otpauth URI import/export, and an urgency countdown — secrets never leave the browser.
1. Generate a code
- Add an entry: paste the Base32 secret from setup, or paste an otpauth://totp/... URI to fill algorithm, digits, and period.
- Pick algorithm (SHA-1 is most common; some services use SHA-256/SHA-512), digits (6/8), and time step (30/60s).
- The tool shows the code with remaining seconds; ≤5s turns amber, ≤3s turns red and pulses — expired codes are the #1 cause of "invalid code" errors.
2. otpauth URI: import and migration
- A Key URI looks like otpauth://totp/Issuer:account?secret=BASE32&algorithm=SHA1&digits=6&period=30.
- Paste into the secret field to import; use the link icon on each row to copy a URI back out for other authenticators.
- This tool accepts digits=6/8 and period=30/60; other values are rejected so you do not silently compute the wrong code.
3. The secret is everything: custody and migration
- The Base32 secret is a permanent code generator: anyone holding it can produce your codes. Never screenshot-share it or leave it in plain-text notes.
- When switching phones, prefer the service's official migration flow (QR transfer), or recreate the entry with the same secret / otpauth URI.
- Entries here live in browser local storage and disappear if you clear browser data — keep a secure copy of secrets in a password manager.
4. Codes keep failing? Check in order
First the countdown: codes generated with under ~5 seconds left often expire before reaching the server. Then the secret (stray spaces / one wrong Base32 character) and algorithm/digits/period must match the issuer. Finally the clock: RFC 6238 recommends verifiers accept ±1 time step — codes only reliably fail once local drift approaches or exceeds a minute; resync then.
5. Time windows and verification strategy
TOTP binds an HMAC to time slices; verifiers often accept the current window ±1 to tolerate clock drift — but multi-window acceptance also keeps a used code valid longer. Stricter implementations record the last successful step and reject replays. This tool implements RFC 6238 in the browser (including SHA-512) with the key never leaving the page — any online tool that ships your secret to a server should be off the table.
6. Operational common sense for shipping TOTP
- Show recovery codes at enrollment and force users to acknowledge saving them — a lost phone with no codes equals a locked account.
- Servers must be NTP-synced: drift beyond one window and nobody can log in — the number-one TOTP incident source.
- Base32 secrets arrive with padding and grouping spaces; normalize before parsing — this tool handles it, and it is a high-frequency bug in hand-rolled integrations.
7. Working with the Base32 tool and password managers
Authenticator secrets are RFC 4648 Base32. If you need to verify the alphabet, restore padding, or rule out a Crockford mix-up, decode in the Base32/Base58 tool first — the wrong alphabet yields codes that look fine but never match. Long-term storage belongs in a password manager OTP field, not a screenshot album; entries on this page live in browser local storage for temporary debugging and migration checks, not as a cloud vault.
FAQ
Computation and storage both stay on your machine: RFC 6238 math runs inside the page and entries live in localStorage, with no server communication whatsoever — any online tool that ships your secret off to a server is one you shouldn't be using.
SHA-1, SHA-256, and SHA-512, 6 or 8 digit codes, and 30 or 60 second time steps. The countdown turns amber at ≤5s and pulses red at ≤3s to nudge you to submit — expired codes are the number one cause of verification failures.
Paste a full otpauth://totp/... link (typically from a decoded QR code or vendor docs) into the add-secret form; the tool parses secret, algorithm, digits, period, and issuer/label into the form for you to confirm. The link icon beside each entry copies the URI back out for migrating to a phone authenticator. Only digits=6/8 and period=30/60 are accepted — other values get a clear unsupported message.
First check that the countdown has more than 5 seconds left; a code generated near expiry is already stale by the time the server sees it. Next confirm the secret has no stray spaces (Base32 has no checksum — one wrong letter changes everything) and that algorithm, digits, and period match the service. Finally check the clock: only a drift of about a minute or more guarantees a mismatch, and calibrating system time fixes it.
A secret is a permanent code source — whoever holds it can generate your codes at will, so no screenshots in group chats and no plaintext notes. Entries here live in browser-local storage and vanish when you clear browser data, so keep another copy in a password manager. Prefer the vendor's official migration flow when switching phones, and save your recovery codes when enabling 2FA — a lost phone without them is a locked account.
It follows the same RFC 6238 standard as mainstream authenticator apps and works well as a browser-side generator for everyday use, debugging, and migration checks. Entries are not cloud-synced, so keep a mobile authenticator as backup for important accounts.
Related Tools
Related Articles
TOTP Two-Factor Authentication Guide: otpauth URI, Algorithms, and Local Debugging
How RFC 6238 TOTP works: algorithms, digits, period, otpauth URIs, countdown windows, and debugging 2FA with a browser-local generator.
Mock Data Generator Complete Guide: Generate Test Data Fast
Generate reproducible test rows with field types, locale samples, and seeds. Export JSON, CSV, TSV, YAML, or SQL for frontend mocks and local DB seeding.
Online JWT Generator/Decoder: JSON Web Token Tool
Learn JWT (JSON Web Token) structure, how it works, and use cases. Mint and decode JWTs with a local browser tool, plus practical signing hygiene.