Home›Security Tools›TOTP Generator
🔐

TOTP Generator & 2FA Setup Tool

Generate and verify RFC 6238 authenticator codes, import or create provisioning secrets, and test compatible settings entirely in your browser.

RFC 6238SHA-1/256/512otpauth + QRLocal verification

Authenticator workspace

Use demo secrets for testing. Treat real enrollment secrets like passwords.

No secret storage
Secret and token settings
Spaces, hyphens and Base32 padding are normalized. An otpauth URI imports its settings.
Enter a Base32 secret or load the safe demonstration value.
Current one-time code
— — —
—
Previous window— — —
Next window— — —
Start the generator before verification.
QR provisioning appears here.
Provisioning URI will appear after the generator starts.
Security warning: anyone who obtains the Base32 secret or provisioning QR can generate the same future codes. Do not reuse a real secret in screenshots, support tickets, demonstrations or shared devices.

Test TOTP without exposing enrollment secrets

TOTP combines a shared secret with a time-based moving counter using HMAC. The server and authenticator generate the same short code when their secret, algorithm, period and clocks agree.

Standards-compatible

Uses the RFC 6238 construction with an eight-byte big-endian counter and HMAC dynamic truncation.

Provisioning support

Import or build otpauth://totp/ URIs for authenticator application enrollment.

Clock-drift testing

Verify the current code or allow the previous and next time windows for limited synchronization tolerance.

How to use the TOTP generator

  1. Enter a Base32 secret, paste an otpauth URI, or generate a new testing secret.
  2. Confirm the algorithm, digit count and period expected by the other system.
  3. Press Start generator to calculate current, previous and next codes.
  4. Use the QR or URI to enroll a test authenticator, then compare its code locally.

Recommended production defaults

Six digits, a 30-second period and SHA-1 remain the most widely interoperable settings. SHA-256 and SHA-512 are supported by RFC 6238 but must also be supported by the authenticator and server.

Frequently Asked Questions

Does ZeeSharp store my TOTP secret?

No. The secret, generated codes and provisioning URI remain in page memory and are not saved to cookies, local storage or ZeeSharp servers.

Why does my authenticator show a different code?

Check the secret, algorithm, digit length and period, then ensure both device clocks are accurate. Even a small clock difference near a window boundary can display adjacent codes.

Is a previous or next-window code safe to accept?

A narrow tolerance can handle clock drift, but it enlarges the valid-code window. Servers should use the smallest tolerance needed and prevent code replay where appropriate.

Can I recover an account from the QR code?

The QR contains the shared secret and configuration, so it can reproduce codes. Store official recovery codes securely instead of keeping unprotected enrollment QR screenshots.