Tool
What the TOTP Generator does
TOTP Generator: generates Status, Current code and Next code from Secret (Base32, as shown by the app or QR code), Digits and Period.
The inputs are Secret (Base32, as shown by the app or QR code), Digits, Period and Algorithm; the output is Status, Current code and Next code. Set your values, then run the tool to see the result.
Typical users are anyone replacing a weak password. A secret that travels to a third-party server is no longer entirely a secret.
Your data stays on your machine. Once the page has loaded you could disconnect entirely and it would still work.
The field reference, the method and a worked example using the default inputs follow the tool itself.
What do the TOTP Generator fields mean?
The TOTP Generator uses 5 inputs. Sensible defaults are loaded up front, which means you can change one number at a time instead of filling the whole form first.
| Field | What to enter | Default |
|---|---|---|
| Secret (Base32, as shown by the app or QR code) | required | JBSWY3DPEHPK3PXP |
| Digits | choose from 6 or 8 | 6 |
| Period | choose from 30 seconds or 60 seconds | 30 seconds |
| Algorithm | choose from SHA-1 (default, Google Authenticator), SHA-256 or SHA-512 | SHA-1 (default, Google Authenticator) |
| Issuer / account (for the otpauth URI) | optional | YoursTools:demo@example.com |
How does the TOTP Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
Inputs are validated before anything is computed, so a bad entry is reported rather than quietly producing a wrong answer.
What a typical run looks like
You provide: Secret (Base32, as shown by the app or QR code), Digits, Period, Algorithm and Issuer / account (for the otpauth URI)
What happens: the file is read into memory by your browser, processed locally, and offered back as a download. It is never uploaded.
You get back: the output file, and a status line reporting what the tool read and wrote.
A fast machine finishes sooner than a slow one, and the only ceiling on file size is the memory available to the page.
How to use it
- Key in Secret (Base32, as shown by the app or QR code).
- Pick a value for Digits: the options are 6 or 8.
- Pick a value for Period: the options are 30 seconds or 60 seconds.
- Pick a value for Algorithm: the options are SHA-1 (default, Google Authenticator), SHA-256 or SHA-512.
- Set Issuer / account (for the otpauth URI).
- Press Generate Code.
- Read Status, Current code, Next code and otpauth URI in the results panel.
- Print gives a tidy version without the navigation, which is handy for attaching to a file.
What this tool does not do
- Anything generated here is only as safe as wherever you store it afterwards.
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- Precision beyond what the inputs justify is not meaningful, however many digits appear.
Frequently asked questions
5 things: Secret (Base32, as shown by the app or QR code), Digits, Period, Algorithm and Issuer / account (for the otpauth URI). Nothing starts empty, so you can change one value at a time and watch how the result responds.
No. There is no upload step, no database, and nothing to delete afterwards.
No payment and no login. Advertising covers the running costs.
It is exact within the stated method. Anything the method does not model is simply out of scope.