What is an OTP generator?
An OTP generator turns a shared secret into a one-time password: the 6-digit code an authenticator app shows when you log in with two-factor authentication. Paste a Base32 secret into the OTP Generator and it shows the same code your authenticator app would show for that secret, right now. It runs in your browser. Nothing you paste is sent anywhere.
There are two kinds of one-time password, and the tool does both:
- TOTP (time-based, RFC 6238). The code changes every 30 seconds. This is what Google Authenticator, Microsoft Authenticator, Authy and 1Password use for nearly every account.
- HOTP (counter-based, RFC 4226). The code changes when a counter goes up by one, usually when you press a button on a hardware token.
Both run the same math. The only difference is what gets fed in as the moving part: the clock, or a counter. The codes here use HMAC-SHA1 and 6 digits, the settings almost every service uses by default.
How to use the OTP Generator
- Pick a mode. TOTP is selected when the page opens. Switch to HOTP if you are testing a counter-based token.
- Enter a secret. The box starts with a random one, so a code is on screen before you type anything. Paste your own Base32 secret over it, or click Generate random for a fresh one. Random secrets are 32 characters long, which is 160 bits.
- Read the code. In TOTP mode a bar counts down to the next 30-second boundary, and the code updates on its own when it hits zero. In HOTP mode, type a counter value or press + Next to step it up by one.
- Copy it. Copy code puts the 6 digits on your clipboard. The copy icon next to the secret copies the secret.
The secret box forgives sloppy pasting. It converts lowercase to uppercase and strips spaces as you type, so gezd gnbv ... copied from a setup screen works the same as the clean version. The eye icon hides the secret if someone is looking over your shoulder.
That's the whole flow. No account, no install, no "connect your authenticator" step. Most 2FA testing tools sit inside a developer platform you pay for by the seat. This one is a text box and a number.
How TOTP and HOTP codes are calculated
Every code comes out of the same four steps:
- Decode the Base32 secret into raw bytes.
- Run HMAC-SHA1 over an 8-byte counter, using the secret as the key. That gives 20 bytes.
- Use the last 4 bits of the result to pick a starting position, then read 4 bytes from there as a number. RFC 4226 calls this dynamic truncation.
- Keep the last 6 digits of that number. That's your code.
For HOTP, the counter is whatever number you give it. For TOTP, the counter is the current Unix time divided by 30, rounded down. So a TOTP code is simply an HOTP code where the clock picks the counter. At Unix time 59, the TOTP counter is 1, and the TOTP code equals the HOTP code for counter 1.
Worked example: the official test vectors
Both RFCs publish test values for the secret 12345678901234567890 (20 ASCII bytes). In Base32 that's GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ. Paste it in, switch to HOTP, and step the counter:
| HOTP counter | Code in this tool | RFC 4226 Appendix D |
|---|---|---|
| 0 | 755224 | 755224 |
| 1 | 287082 | 287082 |
| 2 | 359152 | 359152 |
| 3 | 969429 | 969429 |
| 9 | 520489 | 520489 |
TOTP mode always uses the current time, so you can't type a past timestamp. You can still check the RFC 6238 values: divide the timestamp by 30, round down, and enter the result as an HOTP counter. RFC 6238 lists 8-digit codes. The tool shows 6, which are the last 6 digits of the same number.
| Unix time | Counter (time ÷ 30) | RFC 6238 (8 digits, SHA-1) | This tool (6 digits) |
|---|---|---|---|
| 59 | 1 | 94287082 | 287082 |
| 1111111109 | 37037036 | 07081804 | 081804 |
| 1234567890 | 41152263 | 89005924 | 005924 |
| 2000000000 | 66666666 | 69279037 | 279037 |
If those match on your screen, the math is right. Any mismatch with a real service comes from the inputs: the secret, the clock, or the settings.
Secrets the tool accepts, and why codes don't match
This is the section to read if a code won't verify. Here's what to check first.
The secret must be at least 128 bits
The tool refuses secrets shorter than 16 bytes, which is 26 Base32 characters. That rule comes from the otplib library it runs on, and RFC 4226 itself requires at least 128 bits. The famous 16-character demo secret JBSWY3DPEHPK3PXP is only 10 bytes. Paste it and you'll see "Secret must be at least 16 bytes (128 bits), got 10 bytes" instead of a code. The common 32-character secrets work fine. The ceiling is 64 bytes, about 102 characters.
Only A–Z and 2–7 are allowed
Base32 (RFC 4648) uses the 26 letters plus the digits 2 to 7. The digits 0, 1, 8 and 9 aren't part of it, so a secret containing them is a typo or not Base32 at all. Letters like O, I and L are valid, which is why people misread secrets on screen. If a secret has a 0 in it, it is probably an O.
The settings are fixed at SHA-1, 6 digits, 30 seconds
Those are the defaults in RFC 6238 and in nearly every consumer authenticator. A few systems use SHA-256, SHA-512, 8 digits or a 60-second period. This tool can't switch to those, so its codes won't match such a system. Check the service's otpauth:// link: it carries algorithm=, digits= and period= parameters when they differ from the defaults.
Your clock is off
TOTP depends on both sides agreeing what time it is. If your computer's clock drifts by more than a few seconds, the countdown and the code won't line up with your phone. Turn on automatic time in your system settings and reload the page.
Quick test for a mismatch: put the same secret into this tool and into your authenticator app. If the two agree but the server rejects the code, the server uses different settings or a different secret. If the two disagree, check your clock first.
Fake OTPs, SMS codes and hardware tokens
People search for a "fake OTP generator" or a "random OTP generator". Here's what that can and can't mean.
Click Generate random and you get a real TOTP code from a brand-new secret. It's useful as test data: a valid-looking 6-digit code for a form, a demo or a screenshot. It also works end to end. Add the same secret to an authenticator app and both will show matching codes. If all you need is six random digits with no secret behind them, the random number generator is the simpler tool.
What no OTP generator can do is make a code for someone else's account. The code depends on that account's secret, and only the service and the account owner have it. A code from any other secret is just six digits to the server.
The same goes for SMS verification codes. A bank or app picks those on its own server and texts them to you. There's no secret on your side to compute them from. A "verification code generator" can't predict them.
Hardware OTP tokens are key fobs with a button or a small screen. They keep their secret sealed inside the device. If the vendor gave you the token's seed (some do, for importing into a server), HOTP mode here will reproduce its codes. Without the seed, nothing can.
Who uses an OTP generator
- Developers building 2FA. Generate a secret, store it for a test user, and compare the code your server expects with the one shown here.
- QA testers. Log into a test account with 2FA turned on without passing a phone around the team.
- Anyone with a saved setup key. If you wrote down the secret when you set up 2FA, it still produces your codes on a new device. It needs to be 128 bits or longer to work here.
- The curious. Step through the RFC vectors above and watch the algorithm do exactly what the standard says.
A word of caution. A real account's secret is as sensitive as its password. This page never sends it anywhere, but don't keep it in a note, a chat or a shared doc. For other secrets and strings, the password generator and the token maker run in the browser the same way. To read the secret out of a setup QR code, the QR code reader decodes it to the otpauth:// link.
Frequently asked questions
Why does my 16-character secret show an error?
A 16-character Base32 secret is 80 bits, and the tool requires at least 128 bits (26 characters). The error reads "Secret must be at least 16 bytes (128 bits), got 10 bytes". Most services now issue 32-character secrets, which work. An older 80-bit secret will still work in your authenticator app, but this tool won't accept it.
Can I make 8-digit codes or use SHA-256?
No. The tool is fixed at 6 digits, HMAC-SHA1 and a 30-second period, the RFC defaults that consumer authenticators use. A system set to 8 digits, SHA-256 or SHA-512, or a 60-second period will produce different codes.
How long is a TOTP code valid?
Each code belongs to one 30-second window, which starts on a whole multiple of 30 seconds of Unix time. The countdown bar shows how much of the window is left. Many servers also accept the code from the window just before or after, to allow for slow typing and small clock drift. That's a server setting, not something the code itself controls.
How do I get the secret out of an otpauth:// link?
Look for the secret= parameter. In otpauth://totp/Example:alice?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ&issuer=Example, the secret is everything between secret= and the next &. Paste that part into the tool. If you only have the QR code, decode it to the link first.
Why do TOTP and HOTP show the same code for the same secret?
Sometimes they will, and it's correct. TOTP is HOTP with the counter set to the Unix time divided by 30. When your HOTP counter equals the current time step, both modes compute the same number.
Does the tool keep working after I close it?
No. Nothing is saved. Close the tab and the secret and the code are gone, so keep your own copy of any secret you need later.