Does this tool store or transmit my TOTP secret?

No, the secret you enter or generate, and every code derived from it, are computed with the Web Crypto API inside your browser tab and are never sent anywhere or persisted after you leave the page.

Can I use this to set up 2FA on a real account?

Yes for the QR code and provisioning flow, since it follows the same otpauth:// format authenticator apps expect, but for ongoing use, scan it into a dedicated authenticator app or hardware key rather than relying on a browser tab as your 2FA device.

What's the difference between HOTP and TOTP here?

HOTP (RFC 4226) computes a code from a counter value; TOTP (RFC 6238), what this tool primarily generates, derives that counter from the current time divided into fixed-length periods, so codes rotate automatically.

Why did a code I typed fail validation?

The validator checks the current 30-second (or custom-length) window and the one before it; a code from further in the past, a mismatched digit count, or a wrong algorithm setting won't match.

TOTP Generator & Validator

Generate time-based one-time codes (RFC 6238) from a secret, with a QR code and validator, locally.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Generate and validate RFC 6238 TOTP codes

This tool implements TOTP (RFC 6238) on top of HOTP (RFC 4226), computing HMAC-SHA1, SHA-256 or SHA-512 codes over 30-second (or custom-length) time steps from a Base32 secret. It shows the current code counting down live, renders an otpauth:// QR code you can scan with an authenticator app, and can validate whether a code you enter matches. The secret and any code you check are only ever handled in your browser.

How to use the TOTP Generator & Validator

Enter an existing Base32 secret, or generate a random one.
Set digits (commonly 6), period in seconds (commonly 30) and the HMAC algorithm.
Scan the generated otpauth QR code with an authenticator app, or copy the secret.
Watch the current code and its countdown update automatically as time passes.
Paste a code into the validator to check it against the current and previous window.

The QR code encodes a standard otpauth:// provisioning URI with the secret, issuer, digits, period and algorithm, the same format Google Authenticator, Authy and most password managers scan to set up an account.

Validation checks the current time step and the one immediately before it, a common one-step grace window for clock drift, so a code generated just before it expired can still validate for a short time after.

Frequently asked questions

Does this tool store or transmit my TOTP secret?: No, the secret you enter or generate, and every code derived from it, are computed with the Web Crypto API inside your browser tab and are never sent anywhere or persisted after you leave the page.
Can I use this to set up 2FA on a real account?: Yes for the QR code and provisioning flow, since it follows the same otpauth:// format authenticator apps expect, but for ongoing use, scan it into a dedicated authenticator app or hardware key rather than relying on a browser tab as your 2FA device.
What's the difference between HOTP and TOTP here?: HOTP (RFC 4226) computes a code from a counter value; TOTP (RFC 6238), what this tool primarily generates, derives that counter from the current time divided into fixed-length periods, so codes rotate automatically.
Why did a code I typed fail validation?: The validator checks the current 30-second (or custom-length) window and the one before it; a code from further in the past, a mismatched digit count, or a wrong algorithm setting won't match.