OTP Generator

A Time-based One-Time Password (TOTP) is a short numeric code — typically 6 or 8 digits — that is valid for only a brief window of time, usually 30 or 60 seconds. Once that window expires, the code is gone forever and a brand-new one takes its place. This ephemeral nature is precisely what makes TOTP so effective as a second authentication factor: even if an attacker intercepts a code, it is worthless the moment the time window closes.

TOTP is standardised under RFC 6238, published by the IETF, and is built on top of HMAC-Based One-Time Password (HOTP, RFC 4226). The algorithm requires only two shared pieces of information between the server and the authenticator device: a secret key (encoded in Base32) and the current UTC time. Because both sides independently derive the same counter from the wall clock, they can compute the same OTP without any real-time communication — making TOTP both secure and network-independent.

This OTP generator follows RFC 6238 exactly and is compatible with Google Authenticator, Authy, Microsoft Authenticator, Bitwarden, and any other standard TOTP app. You can generate a random secret key, choose 6 or 8 digit output, and select a 30-second or 60-second period to match your server's configuration.

Two-factor authentication (2FA) using TOTP dramatically reduces account takeover risk. Even if your password is stolen in a data breach, an attacker cannot log in without simultaneous access to the live OTP. This layer of defence is recommended by security agencies worldwide, including NIST SP 800-63B.

Understanding the mechanics behind TOTP helps you appreciate why it is so secure and why you should never share your secret key. Here is a walkthrough of the exact algorithm this tool runs in your browser:

1. Determine the time step counter. Divide the current Unix timestamp (whole seconds since 1970-01-01 00:00:00 UTC) by the period (30 or 60 seconds) and take the floor. For example, at Unix time 1,717,000,020 with a 30-second period, counter = floor(1,717,000,020 / 30) = 57,233,334.
2. Encode the counter as 8 bytes, big-endian. The counter integer is packed into a fixed-length 8-byte buffer, most-significant byte first. This is the message that will be authenticated.
3. Decode the Base32 secret. Each Base32 character maps to 5 bits. The string is decoded into raw bytes that form the HMAC key. Valid characters are A–Z and 2–7 (32 possible values = 2^5).
4. Compute HMAC-SHA-1. The Web Crypto API signs the 8-byte counter with the decoded secret using the HMAC-SHA-1 algorithm. The result is a 20-byte (160-bit) hash.
5. Dynamic truncation. The offset is determined by the last 4 bits of the 20th HMAC byte: offset = hmac[19] & 0x0F. Four consecutive bytes starting at that offset are read: the high bit of the first byte is masked to zero (to avoid sign issues), producing a 31-bit integer called binary.
6. Extract the OTP. Take binary modulo 10^digits. This gives a number in the range [0, 10^digits − 1]. Left-pad with zeros to the required number of digits.

Because every step is deterministic given the same secret and the same time window, both your browser and a remote server arrive at identical codes without any round-trip. The cryptographic strength of HMAC-SHA-1 and the short validity window together ensure that brute-forcing or predicting codes is computationally infeasible in practice.

The secret key is the heart of TOTP security. This tool generates a 20-byte (160-bit) random secret using the browser's crypto.getRandomValues(), which draws from a cryptographically secure pseudorandom number generator (CSPRNG). Each byte is mapped to a Base32 character by computing byte % 32, yielding a 20-character string drawn from the alphabet A–Z and 2–7.

Base32 encoding is used rather than Base64 because it is case-insensitive and avoids characters that are easily confused (0, 1, 8, 9, and lowercase letters). This makes manual entry into authenticator apps less error-prone. The valid Base32 alphabet for TOTP is strictly A–Z and 2–7; any other character is stripped automatically when you type or paste a key.

How to store your secret safely

• Never share your secret key over email, SMS, or chat — treat it like a password.
• Store it in an encrypted password manager (Bitwarden, 1Password, KeePassXC) alongside your account credentials.
• When registering TOTP on a website, save the secret before scanning the QR code so you can recover access if you lose your device.
• If you suspect a secret has been compromised, immediately disable TOTP on the associated account and re-enrol with a fresh secret.

A 20-byte secret provides 160 bits of entropy — far beyond what any current or near-future computing system can brute-force. Even a 10-byte (80-bit) secret, which some older systems still use, remains practically unbreakable through exhaustive search. The real attack vectors are phishing (entering a real OTP on a fake site) and secret leakage, not cryptanalysis.

This tool offers two configurable parameters that must match your server's TOTP settings exactly, or the codes will not validate.

OTP Length: 6 vs. 8 Digits

6 digits is the most common choice and the default in RFC 6238. It provides 1,000,000 possible values per time window, which is more than sufficient given that most servers rate-limit and lock accounts after a few failed attempts. The vast majority of websites — Google, GitHub, Dropbox, AWS — use 6-digit TOTP.

8 digits provides 100,000,000 possible values, reducing the guessing probability by a factor of 100. It is sometimes used by high-security or enterprise systems. If you enter the wrong length here, the code you generate will never match the server's expectation.

Time Period: 30 vs. 60 Seconds

The 30-second period is the standard defined in RFC 6238 and used by almost all TOTP implementations. A 30-second window balances security (short enough to limit replay attacks) with usability (enough time to read and type a 6-digit code).

A 60-second period doubles the window, giving users more time to enter the code — useful for accessibility or slow-input scenarios. Some enterprise platforms and hardware tokens use a 60-second period. Using the wrong period produces a counter that is off by a factor of two, so every generated code will be wrong.

The countdown bar in this tool shows exactly how many seconds remain in the current window. When it hits zero, a new code is generated automatically and the bar resets.

TOTP dramatically improves account security but is not invulnerable. Understanding its strengths and limitations helps you deploy it responsibly.

Strengths

• No network required: Codes are generated entirely offline on the client device, eliminating SMS interception attacks (SIM-swapping, SS7 exploitation).
• Short validity: A stolen OTP becomes useless within 30–60 seconds.
• Open standard: RFC 6238 / RFC 4226 are publicly audited and widely implemented, reducing the risk of implementation flaws.
• Phishing resistance (partial): Unlike static passwords, replaying a captured OTP on the real site within the same window is difficult but not impossible.

Limitations

• Real-time phishing: Sophisticated attackers can relay the OTP to the real site within the 30-second window (adversary-in-the-middle attacks). Hardware security keys (FIDO2/WebAuthn) are the gold standard against this.
• Clock skew: If your device's clock drifts significantly, codes will not match. Most servers allow a ±1 step tolerance, but large drift will cause failures. Keep your system clock synchronised (NTP).
• Secret backup: If you lose your device without a backup of the secret, you may be locked out. Always store the secret in a second secure location.
• In-browser security: This tool performs all computation locally in your browser using the Web Crypto API — your secret is never sent to any server. Always verify you are on the correct URL before entering secrets.

For accounts where security is paramount — financial services, cloud infrastructure, email — combine TOTP with a strong unique password and consider upgrading to a FIDO2 hardware key for the highest level of phishing resistance.

Not all one-time password systems are equal. Here is a comparison of the three most common OTP methods to help you choose the right approach.

TOTP is generally preferred over HOTP because the time-based counter self-synchronises — there is no risk of the client and server counters drifting apart through missed increments. SMS OTP should be avoided for high-value accounts because it is vulnerable to SIM-swapping, SS7 attacks, and malware. TOTP via an authenticator app is the current best practice for widely-supported 2FA, with FIDO2/passkeys being the emerging gold standard.