Home / Password Security / TOTP / 2FA QR

TOTP Generator & 2FA QR Code

Enter a base32 secret to generate current 6-digit TOTP codes and a scannable QR code for Google Authenticator — all computed locally.

Why Use This Tool?

Two-factor authentication via TOTP (Time-based One-Time Password) works by sharing a secret between you and the service, then computing a 6-digit code that changes every 30 seconds. This tool generates those codes and the QR code that authenticator apps scan — all locally, no server involved.

The QR code encodes the standard otpauth:// URI that Google Authenticator, Authy, and all TOTP apps understand. Scan it with your authenticator app to add the account, then use the 6-digit code to verify.

How It Works

  1. Enter your base32 secret key (from the service's 2FA setup page).
  2. Click generate — the current 6-digit code and QR code appear.
  3. Scan the QR with your authenticator app, or copy the 6-digit code manually.

What Is the TOTP Algorithm?

TOTP (Time-based One-Time Password) is defined in RFC 6238. It combines a shared secret with the current time counter (Unix time ÷ 30) using HMAC-SHA1, then truncates the result to 6 digits. Both the client and server compute the same code independently.

Common Use Cases

  • Setting up 2FA for any TOTP-compatible service
  • Testing 2FA implementations during development
  • Generating backup codes when your authenticator is unavailable
  • Understanding the TOTP algorithm for educational purposes

Frequently Asked Questions

How does TOTP work?

TOTP combines your secret key with the current time (in 30-second intervals) using HMAC-SHA1. Both your device and the server compute the same code independently — no network needed after setup.

What is the otpauth:// URI?

It's the standard format that authenticator apps understand: otpauth://totp/Label?secret=KEY&issuer=Name. The QR code encodes this URI so apps can add the account automatically.

Why does the code change every 30 seconds?

The time-based counter increments every 30 seconds, producing a new HMAC each interval. This means a stolen code is useless within 30 seconds.

Is my TOTP secret sent anywhere?

No. The base32 decoding, HMAC computation, and QR generation all happen in your browser. The secret never leaves your device.

Tips & Things to Watch

  • The countdown timer shows exactly when the code refreshes.
  • QR codes work with Google Authenticator, Authy, Microsoft Authenticator and all TOTP apps.
  • Test with the TOTP Secret Generator first to create a valid key.
  • The code is valid for 30 seconds — if it expires before you use it, just generate a new one.

Privacy & Your Data