TOTP Generator & Reader — 2FA Secrets, QR Codes and Live Codes
Generate a 2FA secret and QR code, read a QR code back to its secret, get live codes from any secret, and verify codes — all in your browser.
🔒 Runs in your browser — files never uploaded ⚡ No signup 💯 Free
Algorithm, digits and period (defaults suit every major app)
Google Authenticator ignores non-default values and always uses SHA1 / 6 digits / 30 s. Authy, 1Password, Bitwarden, Aegis and Microsoft Authenticator honour them.
Scan with Google Authenticator, Authy,
1Password, Bitwarden or any TOTP app
Checks a code the way a server does, against the secret and settings in the Generate tab. Expected right now: ——— ———
Everything around a TOTP secret in one place. Generate a new secret with its QR code and watch the live six-digit codes tick over, or paste any existing secret to get its current code. Read a 2FA QR code — a screenshot, a photo, or a Google Authenticator "transfer accounts" export — and get the secret, issuer, algorithm and live code back out of it. Verify a code the way a server does, with a configurable drift window, to find out whether a failing login is the secret, the clock or the code.
It is the real RFC 6238 pipeline (Base32 secret, HMAC over the 30-second counter, dynamic truncation) computed with your browser's own Web Crypto, so the codes match Google Authenticator, Authy, 1Password, Bitwarden and Microsoft Authenticator exactly. No secret, image or code is uploaded anywhere.
How to use TOTP Generator (2FA)
- Generate: click New secret, set the issuer and account the app should display, then scan the QR code or download it as a PNG. The live code on the right should match the app within a second.
- Get a code from a secret: paste the Base32 secret (or a whole
otpauth://URI) into the secret box. The current and next codes appear immediately. - Read a QR code: open the Read tab and drop a screenshot or photo of the QR, or paste the
otpauth://text. A Google Authenticator export with several accounts lists each one with its own live code; click Use to load one into the generator. - Verify a code: type the code from a device into the Verify tab. It reports valid, valid-with-drift (and by how many steps), or not valid.
How TOTP actually works
Both sides share a secret and both know the time. Every 30 seconds each computes HMAC-SHA1(secret, number of 30-second intervals since 1970), takes four bytes from the result at an offset chosen by its last nibble, and reduces them to six digits. No network is needed, which is why authenticator apps work in airplane mode and why a wrong phone clock breaks 2FA. Servers usually accept one interval of drift either way; the Verify tab lets you set that window.
Reading a QR code back to its secret
A 2FA QR code is nothing more than a text URI, otpauth://totp/Issuer:account?secret=…&issuer=…, with optional algorithm, digits and period parameters. The Read tab decodes the image in the browser (with the built-in barcode detector where available, otherwise a JavaScript decoder) and parses that URI. That is useful when a service only shows a QR code but you need the text secret for a password manager, a second device, or your own server tests.
Google Authenticator's Transfer accounts screen produces a different kind of QR, otpauth-migration://offline?data=…, whose payload is a small binary (protobuf) message holding every exported account. This tool decodes that too, so you can move accounts to another app or simply see what was in the export. Treat such an export as you would a list of passwords.
Algorithms, digits and periods
Almost every service uses SHA1, six digits and a 30-second period, and those are the defaults here. Some systems (Yubico, some banks, many self-hosted setups) use SHA256 or SHA512, eight digits, or a 60-second period; the generator supports all of them and writes them into the QR. Note that Google Authenticator ignores these parameters and always uses the defaults, so a SHA256 secret enrolled there will produce wrong codes; Authy, 1Password, Bitwarden, Aegis and Microsoft Authenticator honour them. MD5 appears in some old exports but is not supported by browsers and is shown as unsupported.
Testing a server implementation
If you are adding 2FA to your own system: generate a per-user random secret (160 bits, as this tool does), store it encrypted, show the QR once at enrolment, verify with a ±1 interval window, and offer recovery codes. Then check your code against this page: the same secret and time must give the same digits, and the RFC 6238 test vectors (secret 12345678901234567890, time 59 → 94287082 with eight digits) are reproduced here exactly. The hash generator and QR code generator cover the neighbouring pieces, and the QR scanner reads any other kind of QR code.
A word of caution
The secret is the second factor. Anyone holding it can produce your codes forever, and a screenshot of an enrolment QR is exactly as sensitive. This page keeps everything in your browser and stores nothing, but the habit matters more than any one site: decode only QR codes you own, and let real services generate their own secrets straight into your app.
Frequently asked questions
How do I get the TOTP secret out of a QR code?
Open the Read tab and drop a screenshot or photo of the QR code. The page decodes it in your browser and shows the secret, issuer, account, algorithm, digits and period, plus the live code. It also reads Google Authenticator's "transfer accounts" export QR, listing every account inside it.
Can I generate a code from a secret I already have?
Yes. Paste the Base32 secret into the secret box on the Generate tab and the current and next codes appear at once. If what you have is an otpauth:// URI, paste the whole thing: the issuer, account and settings are filled in from it.
My authenticator app shows different codes — why?
Almost always the clock: TOTP depends on both sides agreeing on the time to within a few seconds. Check that the phone uses automatic time. Other causes are a mistyped secret (0 vs O, 1 vs I), or non-default settings such as SHA256 or eight digits that the app ignores (Google Authenticator does). The Verify tab tells you whether a code is valid for a nearby time step, which points at drift.
Is anything sent to your server?
No. Secrets, QR images, codes and exports are processed entirely in your browser with its built-in Web Crypto and canvas; nothing is uploaded or stored. You can load the page and disconnect from the network before using it.
What is inside a 2FA QR code?
A text URI such as otpauth://totp/GitHub:alice?secret=JBSWY3DPEHPK3PXP&issuer=GitHub. The secret is Base32; algorithm, digits and period are optional and default to SHA1, 6 and 30. The Setup URI box under the QR shows exactly what this page encodes.
Does this work with Google Authenticator exports?
Yes. The export QR encodes an otpauth-migration:// link whose data is a small binary message with every account. Drop the QR image or paste the link into the Read tab to see each account's secret and live code. Keep in mind that such an export is as sensitive as all of those secrets together.
Which algorithms, digit counts and periods are supported?
SHA1, SHA256 and SHA512; six or eight digits; 15, 30 or 60-second periods, for both generating and reading. HOTP (counter-based) accounts found in a QR are decoded and their code at the stored counter is shown. MD5 is not available in browsers and is reported as unsupported.
Is it safe to generate a real 2FA secret here?
For a service you run or test, yes: the secret is produced by the browser's cryptographic random generator and never leaves the page. For accounts on other services, let the service generate the secret and scan it straight into your app; never paste an existing account's secret into any website, including this one.