# TOTP Generator - 2FA Code Tester, otpauth URI and QR Code

> Generate and verify TOTP / HOTP 2FA codes from a Base32 secret or otpauth:// URI. SHA1/256/512, 6–8 digits, custom period, countdown, new secrets and QR codes.

- URL: https://qilingtools.com/en/totp
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Date & Time](https://qilingtools.com/en/tags/time), [Developer](https://qilingtools.com/en/tags/dev)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

When you build two-factor authentication you need a code generator to check against. Paste a Base32 secret, or a whole otpauth://totp/… URI (the issuer, account, algorithm, digits and period are read automatically), and you’ll see the current code with a countdown ring plus the previous and next codes — handy for spotting clock drift between a server and a phone. SHA-1, SHA-256 and SHA-512, 6 to 8 digits and any period are supported, as is counter-based HOTP. To enroll a new account, generate a random secret and get a standard otpauth:// URI and QR code that Google Authenticator, Microsoft Authenticator, 1Password and similar apps can scan. You can also verify a code within a ±N step tolerance window and see which step it matched. HMACs are computed with the browser’s WebCrypto and pass every RFC 6238 and RFC 4226 test vector; “Use a fixed time” reproduces the RFC examples. The secret lives only in this page’s memory and is never uploaded or stored — still, don’t paste real production secrets on a shared computer.

## How to use

1. Paste a Base32 secret or otpauth:// URI, or click “Generate random secret”
2. Adjust algorithm, digits and period, and read the current, previous and next codes
3. Copy the otpauth URI or scan the QR code, and test codes in “Verify a code”

## Features

- TOTP (RFC 6238) and HOTP (RFC 4226)
- SHA-1 / SHA-256 / SHA-512, 6–8 digits, custom period
- Parse and build otpauth:// URIs (Key URI format)
- Countdown ring with previous and next codes
- Random secret generation with QR code
- ±N step tolerance check that reports the offset
- Fixed timestamps to reproduce RFC test vectors
- Computed locally; nothing is stored

## FAQ

### Why doesn’t my code match the authenticator app?

Usually it’s the clock. TOTP divides the current time by the period (normally 30 seconds) to get a counter, so a clock that’s off by more than one period produces a different code — compare with the previous / next codes to see which way it’s off. Then check the algorithm and digits: many apps only support SHA-1, 6 digits and 30 seconds and silently ignore other settings.

### What does an otpauth:// URI look like?

The standard form is otpauth://totp/Issuer:account?secret=BASE32SECRET&issuer=Issuer&algorithm=SHA1&digits=6&period=30. Only secret is required; the rest default to SHA1, 6 digits and 30 seconds. For HOTP replace totp with hotp and use a counter parameter instead of period. That’s the URI this tool builds, and it’s exactly what the QR code contains.

### How large should the server’s tolerance window be?

±1 step (30 seconds either way) is usually enough to absorb clock drift and typing time, and RFC 6238 recommends allowing no more than one step of network delay. A larger window makes guessing easier. Also remember which time steps were already used so the same code can’t be replayed while it’s still valid.

### Is it safe to paste a secret here?

Everything is computed in your browser; the secret is never sent anywhere or written to storage, and it’s gone when you close the page. But a TOTP secret is effectively a second password — anyone who sees your screen, a screenshot or your clipboard can generate codes — so avoid real production secrets on shared computers and test with a freshly generated one.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.