TOTP/HOTP Generator
Build a TOTP/HOTP otpauth:// provisioning URI (RFC 6238 / RFC 4226) from a Base32 secret, issuer and account name — the same payload a 2FA setup QR code encodes — plus a preview of the current code.
Input
The service name shown in the authenticator app. Optional.
The shared secret to encode. Lowercase and missing padding are handled automatically.
The moment to compute the current-code preview for. Paste the current Unix time to match what an authenticator app shows right now.
Output
For TOTP this is floor(timestamp / period); for HOTP it is the counter you entered.
Guides
The TOTP/HOTP Generator builds a two-factor authentication provisioning URI — the same otpauth:// payload an authenticator app's QR code encodes — from a Base32 secret, an issuer and an account name, following RFC 6238 (time-based, TOTP) and RFC 4226 (counter-based, HOTP). It also previews the current code the setup would produce. Everything runs in your browser; the secret is never uploaded, and share links only ever carry your algorithm/digit/period settings, never the secret itself.
How it works
- Choose TOTP (rotates on a timer — the standard for 2FA apps) or HOTP (advances on a counter, used by hardware tokens like early YubiKeys).
- Enter the Issuer (the service name shown in the app) and Account (usually an email or username) — together they form the label an authenticator app displays.
- Provide the Secret as Base32 (letters A-Z and digits 2-7). If you're setting up a new 2FA secret, generate a random Base32 string elsewhere and paste it here to build the matching URI and preview its first code.
- Pick the hash Algorithm (SHA-1 is what almost every app supports; SHA-256/512 are used by some hardware tokens), Digits (6 is standard, 8 is used by some enterprise systems), and — for TOTP — the rotation Period.
- For TOTP, the Preview at Unix timestamp field computes what code the setup shows at that exact moment (paste
Math.floor(Date.now() / 1000)for "right now"). For HOTP, the Counter field does the same for a specific counter value.
Reading the results
- OTP Auth URI — the full
otpauth://totp/...orotpauth://hotp/...string. Most authenticator apps can import a secret directly from this URI if you encode it into a QR code with any QR generator, or via a "manual entry" flow using the secret, issuer and settings directly. - Current Code — the one-time code the setup would show at the given timestamp/counter.
- Counter Value Used — for TOTP this is
floor(timestamp / period); for HOTP it's the counter you entered. - Seconds Remaining in Period — how long until a TOTP code rotates (blank for HOTP).
Why doesn't this tool generate a QR code image?
Rendering a scannable QR code needs a <canvas>, which can't exist in this tool's pure, browser/API/MCP-portable core. Paste the OTP Auth URI into any QR code generator to get a scannable image, or type the secret, issuer, algorithm, digits and period into your authenticator app's "manual entry" screen — most apps support this and it's equivalent to scanning a QR code.
I already have a secret and just want the current code, no URI
See the OTP Code Generator — it's the leaner "compute a code from an existing secret" counterpart to this tool's "set up a new 2FA secret" focus.