How TOTP and HOTP Codes Work
This otp code generator online implements both standard one-time password algorithms defined by the IETF. A hotp generator (HOTP, RFC 4226) derives a code from a shared secret and a counter that increments by one each time a new code is requested, the same counter value always produces the same code. A time based otp generator, TOTP (RFC 6238), is HOTP with the counter replaced by the current time divided into fixed-length windows (typically 30 seconds), so the code automatically changes as time passes without either side needing to track state, this is the algorithm used by virtually every authenticator app. Use it to generate totp code online whenever you need to verify or test a time-based flow.
Generating a Secret and Setting Up an Authenticator
This base32 secret generator produces a random 160-bit secret encoded in Base32 (the format authenticator apps expect), suitable for setting up a new TOTP entry manually. Paste the generated secret into an authenticator app's manual-entry option (as an alternative to scanning a QR code), then use this tool with the same secret and settings to independently verify the app is producing matching codes before relying on it.
Choosing Digits, Period, and Algorithm
Most real-world services use 6-digit codes, a 30-second period, and SHA-1, the original RFC 6238 defaults, and changing any of these only matters if the service you're generating codes for explicitly uses different settings. 8-digit codes and longer periods (up to 120 seconds) are supported for services that deviate from the defaults, as is choosing SHA-256 or SHA-512 as the hash algorithm instead of SHA-1.
Common Uses
Testing a two factor authentication code generator integration during development, verifying an authenticator app is configured correctly before relying on it for a real account, and learning how TOTP and HOTP actually work under the hood are all common uses. It's also useful as an emergency fallback for generating a code from a secret you've saved separately if your primary authenticator app code generator is temporarily unavailable.
What This Tool Doesn't Do
It doesn't generate a scannable QR code for the secret, only the raw Base32 text, and it doesn't store secrets between sessions, each one exists only in the browser tab for as long as the page stays open. It also isn't a replacement for a dedicated authenticator app for securing real accounts long-term, treat it as a testing, learning, and verification tool rather than your primary 2FA code generator ongoing.