TOTP Generator
Paste a Base32 secret or click New secret. Codes stay in this browser.
Not an authenticator app. Anyone with the secret can mint codes. Nothing is uploaded.
TOTP generator — test authenticator codes locally
Generate and validate TOTP (and HOTP) codes from a Base32 secret.Toolshelf does not upload the secret and does not talk to Google or GitHub.
Clock skew and QR
Previous and next period codes help debug clock skew. Optional issuer and account build an otpauth URI and QR. For a random password instead, use the password generator.
TOTP FAQ
- What is a TOTP generator?
- TOTP (time-based one-time password) is the 6- or 8-digit code an authenticator app shows. This page mints and checks those codes from a Base32 secret in your browser.
- What is the difference between TOTP and HOTP?
- TOTP uses the current time divided by a period (usually 30 seconds). HOTP uses an incrementing counter. Authenticator apps almost always use TOTP with SHA-1.
- Why is SHA-1 the default?
- RFC 6238 authenticators (Google/Microsoft Authenticator and similar) default to HMAC-SHA-1. SHA-256 and SHA-512 are available when a server asks for them.
- Is my secret uploaded?
- No. Toolshelf computes HMAC locally. The secret is not stored unless you check “Remember secret on this device,” and then it stays in this browser’s local storage.
- Can I use this instead of Google Authenticator?
- No. This is a developer test tool: no account backup, no push, no cloud. Do not paste production secrets on a shared computer.
Related tools
Continue with related browser-based tools on Toolshelf.
- Password Generator & Strength Checker — Generate strong random passwords and check password strength instantly.
- QR Code Generator — Create QR codes for URLs, text, Wi-Fi, contacts, email, phone numbers and more.
- JWT Decoder & Inspector — Online JWT decoder and inspector.
- Hash Generator — Online hash generator.
- Lorem Ipsum Generator — Lorem ipsum generator online.
- Meta Tag Generator — Meta tag generator online.
- Emoji Maker — Emoji maker online.
- SVG Placeholder — SVG placeholder generator online.
Examples
RFC 6238 SHA-1
At Unix time 59 with the RFC test secret, 8-digit SHA-1 TOTP is 94287082.
Limitations
- Not an authenticator app: no backup, no push, no many-account vault.
- The secret is stored only if you check remember-on-this-device.
- Validation uses a ±1 period window.
What would you like to do next?
Continue working with the next step in this workflow. Recently used tools in this set are listed first.
- Password Generator & Strength Checker — Generate strong random passwords and check password strength instantly.
- QR Code Generator — Create QR codes for URLs, text, Wi-Fi, contacts, email, phone numbers and more.
- JWT Decoder & Inspector — Online JWT decoder and inspector.
- Hash Generator — Online hash generator.
You may also need
Continue with related browser-based tools on Toolshelf.
- Password Generator & Strength Checker — Generate strong random passwords and check password strength instantly.
- QR Code Generator — Create QR codes for URLs, text, Wi-Fi, contacts, email, phone numbers and more.
- JWT Decoder & Inspector — Online JWT decoder and inspector.
- Hash Generator — Online hash generator.
- Lorem Ipsum Generator — Lorem ipsum generator online.
- Meta Tag Generator — Meta tag generator online.
- Emoji Maker — Emoji maker online.
- SVG Placeholder — SVG placeholder generator online.