TOTP Generator with Countdown and otpauth URIs

How TOTP one-time passwords are generated

TOTP (Time-based One-Time Password, RFC 6238) is the algorithm behind the six-digit codes in Google Authenticator, Microsoft Authenticator, 1Password, Authy and most other 2FA apps. The server and the app share a secret key, usually shown to you once as a QR code or a base32 string like JBSWY3DPEHPK3PXP. Both sides then compute the same code independently from that secret and the current time, so nothing needs to be sent between them.

The steps are simple. Take the Unix time in seconds and divide by the period, normally 30, rounding down; that integer is the counter T. Compute an HMAC of T, written as an 8-byte big-endian number, using the secret as the key; SHA-1 is the default hash, with SHA-256 and SHA-512 as options. Then apply the dynamic truncation from RFC 4226 (HOTP): the low 4 bits of the last HMAC byte pick an offset, four bytes from that offset form a 31-bit integer, and that integer modulo 10^6 (or 10^8) is the code, zero-padded. This one time password generator does exactly that with the browser's Web Crypto HMAC implementation and shows the counter so you can follow along.

The implementation is checked against the test vectors in RFC 6238 Appendix B. For the SHA-1 test key "12345678901234567890" at T = 59 seconds with 8 digits the expected code is 94287082, and the SHA-256 and SHA-512 vectors (46119246 and 90693936) match as well.

Using this 2FA code generator for development and testing

The main use is building or debugging two-factor login. Generate a random secret (20 bytes for SHA-1, matching the RFC 4226 recommendation, or 32 and 64 bytes for SHA-256 and SHA-512), store it for a test user, and compare the code your server expects with the code shown here. The previous and next codes are listed too, because most servers accept one step either side to tolerate clock drift; if your server only matches the previous or next code, one of the clocks is off by roughly a period.

The otpauth:// URI builder produces the Key URI Format that authenticator apps read from QR codes: otpauth://totp/Issuer:account?secret=...&issuer=.... Algorithm, digits and period are added only when they differ from the defaults. Be aware that several popular apps ignore those three parameters and silently fall back to SHA-1, 6 digits and 30 seconds, so a mismatch between the app and your server is often caused by a non-default setting, not by your code.

Common causes of wrong codes: the secret was decoded as text instead of base32, the server clock is not synced with NTP, the period is 60 on one side and 30 on the other, or leading zeros were dropped because the code was stored as a number.

Keep real secrets off the web

Everything here runs locally: the secret stays in this browser tab, nothing is stored, and there is deliberately no share link. Even so, treat any website as the wrong place for the 2FA secret of a real account. Anyone who has that secret can produce your codes forever. Use this page with test accounts and generated secrets, and keep production secrets in a proper authenticator or password manager.