TOTP Generator — 2FA QR Code & Live Codes Free

Generate a TOTP secret, get the QR code any authenticator app can scan, and watch the live 6-digit codes tick over every 30 seconds — the full RFC 6238 pipeline, computed in your browser with the same HMAC-SHA1 the apps use.

Built for developers adding 2FA to their own systems, for testing authenticator apps, and for understanding what's actually inside that QR code. The secret never leaves the page.

How to use TOTP Generator (2FA)

Generate a secret (or paste a Base32 one you're testing with).
Set issuer and account — the labels the authenticator app will display.
Scan the QR with Google Authenticator, Authy, 1Password or any TOTP app.
Compare codes: the app and this page should show the same 6 digits, changing together every 30 seconds. If they don't, check the device clock.

How TOTP actually works

Disarmingly simple: both sides share a secret, both know the time. Every 30 seconds, each computes HMAC-SHA1(secret, current-30-second-interval), truncates it to 6 digits, and compares. No network needed — which is why authenticator apps work in airplane mode, and why a wrong phone clock breaks 2FA (servers usually accept one interval of drift either way).

What the QR code contains

An otpauth://totp/… URI carrying the secret, issuer and account label, plus the parameters (SHA1, 6 digits, 30 seconds — the defaults nearly everything uses). The URI is shown below the QR so you can see there's no magic — and understand why a 2FA QR code screenshot is exactly as sensitive as the secret itself.

For developers implementing 2FA

Generate a per-user random secret (160 bits, as here), store it encrypted, show the QR once at enrolment, verify with a ±1 interval window, and offer recovery codes for lost phones. Verify your server implementation against RFC 6238's test vectors — this page computes them correctly, so it doubles as a reference to check against.

A word of caution

The secret is the second factor. Never paste a real account's existing 2FA secret anywhere — not into any website, including this one. (Here it stays in your browser; the habit is still the protection.) For real accounts, let each service generate its own secret and scan it straight into your app.

Frequently asked questions

My authenticator app shows different codes — why?

Almost always the clock: TOTP is pure time + secret, so a device clock a minute off produces different codes. Check the phone's automatic time setting. Second suspect: a typo in the secret — Base32 has no 0, 1, 8 or 9, so those characters mean a transcription error.

Is it safe to generate a real 2FA secret here?

For a system you are building or testing, yes — the secret is generated and kept in your browser. For enrolling in someone else's service, use the secret that service generates, and never re-type an existing account's secret into any website. The rule that keeps 2FA safe is that the secret only ever lives in the service and your authenticator.

Why does 2FA work without internet on my phone?

Because nothing is transmitted: your phone computes HMAC(secret, time) locally, the server does the same, and they compare. The QR enrolment was the only data transfer that ever happened. It's the elegance of the design — and why it keeps working in airplane mode.

What is inside the QR code?

An otpauth://totp/Issuer:account?secret=… URI — shown in full below the QR here. That's why a screenshot of a 2FA setup QR is exactly as sensitive as the secret: anyone who scans it can generate your codes forever.

Can I verify my server's TOTP implementation against this?

Yes — this page implements RFC 6238 (HMAC-SHA1, 6 digits, 30-second steps) and matches the RFC's own test vectors, so if your server disagrees with it for the same secret and time, the bug is on your side. Remember to allow ±1 time step for clock drift when verifying users.