TOTP Generator

Generate and verify standards-based SHA-1 TOTP codes locally from a Base32 secret.

Config generator Security & Crypto Runs in your browser

Result

TOTP code
260025
Valid for
30 seconds
Counter
58907520
Provisioning URI
otpauth://totp/Netvorx:engineer%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=Netvorx&period=30&digits=6
The secret and code are computed in your browser and are not uploaded. Avoid using a real production secret on an untrusted or shared device.

About TOTP Generator

TOTP derives a short-lived code from a shared secret and time counter. This implementation uses HMAC-SHA-1, the common RFC 6238 compatibility profile, and performs the operation locally.

How the code is derived

The Unix time is divided into fixed periods, encoded as a counter and authenticated with the shared secret. Dynamic truncation converts that digest into the requested six- or eight-digit code.

Secure provisioning

The provisioning URI contains the secret in readable form and must be protected during enrolment. Do not send it through untrusted chat, tickets or logs. Store recovery codes separately, require a second administrator for privileged accounts and rotate a secret that may have been exposed. Verification servers normally allow a small time window for clock skew, but wide windows weaken replay resistance. Keep clients and servers synchronised with reliable time sources.

Common use cases

  • Validate a TOTP implementation against a fixed timestamp.
  • Create a provisioning URI for a lab account.
  • Troubleshoot clock drift or digit-length mismatches.

Edge cases and gotchas

  • Clock drift causes valid codes to be rejected.
  • Treat the Base32 secret like a password.
  • Use this output for implementation testing or controlled provisioning, not as a replacement for an identity system’s enrolment, recovery, replay protection, rate limiting and audit controls.

Frequently asked questions

Can I enter a production secret?
The calculation is local, but sensitive secrets should still be handled only on a trusted private device. Clear the field afterwards, never capture it in screenshots, and rotate the credential immediately if it was exposed to another person or system.
Why does another authenticator show a different code?
Check the Base32 secret, Unix time, period, digit count and algorithm. Even a small clock difference near a period boundary can show the previous or next code.