TOTP / OTP Code Generator for Two-Factor Authentication

• Generates TOTP (time-based) and HOTP (counter-based) one-time passwords
• Standard 6-digit codes that refresh every 30 seconds (TOTP)
• Compatible with Google Authenticator, Authy, and other 2FA apps
• Uses HMAC-SHA1, SHA256, or SHA512 algorithms per RFC 6238
• Useful for developers testing 2FA integration in their applications

Use Cases

Frequently Asked Questions

How does TOTP two-factor authentication work?

TOTP combines a shared secret key with the current time (divided into 30-second windows) using HMAC to generate a short-lived 6-digit code. Both the authenticator app and server compute the same code independently — if they match, login succeeds.

Which authenticator apps are compatible with this tool?

All TOTP-compatible apps: Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, FreeOTP, and any app that supports otpauth:// URIs and RFC 6238.

Why does my authenticator show a different code than this tool?

Common causes: clock drift (sync your device time via NTP), wrong secret key encoding, algorithm mismatch (SHA-1 vs SHA-256), different time period (30s vs 60s), or digit count mismatch (6 vs 8 digits).

What is the difference between TOTP and HOTP?

TOTP is time-based — codes change every 30 seconds. HOTP is counter-based — codes change only when the counter increments. TOTP is more common because it doesn't require counter synchronization between devices.

Can I use this to set up 2FA for my own application?

Yes. Generate a Base32 secret, create a QR code with the otpauth:// URI, let users scan it with their authenticator app, and verify codes on your server using a TOTP library (speakeasy for Node.js, pyotp for Python).

Is TOTP secure enough for production authentication?

Yes. TOTP is a proven standard used by Google, GitHub, AWS, and most major services. For highest security, combine TOTP with phishing-resistant methods like WebAuthn/passkeys as a primary factor.