← All Tools
TOTP Generator & Verifier
Generate and verify Time-based One-Time Passwords per RFC 6238.
All processing happens locally in your browser using Web Crypto API. Nothing is sent to any server.
Import otpauth:// URI
Paste an existing provisioning URI to populate every field below.
Secret Key
Secret length: 160 bits (20 bytes). RFC 6238 recommends a key at least as long as the HMAC hash (SHA-1: 160-bit, SHA-256: 256-bit, SHA-512: 512-bit).
Settings
Provisioning URI
About TOTP
RFC 6238
- HMAC-based counter from Unix time
- Default: 30s period, 6 digits, SHA-1
- Dynamic truncation of HMAC output
- Compatible with Google Authenticator
Security Notes
- Keep secrets confidential
- Use SHA-256/512 when supported
- Consider time skew (±1 window)
- Secrets should be at least 160 bits