TOTP / HOTP Generator & Verifier
Generate and verify TOTP and HOTP codes locally with Base32 secrets, explicit clocks and bounded verification windows.
Anyone with the OTP secret can generate valid codes. Secrets and codes stay in browser memory; no account or remote authentication service is contacted.
Browser clock (UTC): —
Wider windows reduce verification strictness. TOTP depends on reasonably synchronized clocks. HOTP counters never advance automatically. This tool does not enforce replay prevention or rate limits.
Ready.
Generate and verify one-time passwords locally.
TOTP derives an HMAC counter from Unix seconds and your selected period, using the Unix epoch as T0. HOTP uses an explicit unsigned 64-bit counter. Choose 6 or 8 digits and SHA-1, SHA-256 or SHA-512. RFC 4226 defines HOTP with SHA-1; SHA-256/512 HOTP variants require matching support in the other application. HMAC-SHA1 remains an interoperability option here; it is not equivalent to plain SHA-1 hashing.
Use an explicit secret, clock and window.
Base32 accepts letters A–Z and digits 2–7, case-insensitively, with optional canonical padding. Only ASCII spaces are ignored. Invalid padding and nonzero trailing bits are rejected. Secrets must decode to 16–256 bytes, with at most 512 input characters. Generate secure secret creates 32 random bytes using the browser’s cryptographic random source.
Periods range from 15 to 300 seconds. Browser time is captured on Generate or Verify; codes do not refresh automatically. The countdown indicates when a generated browser-time code has expired. Custom whole Unix seconds make tests reproducible. TOTP windows allow ±0–2 periods; HOTP permits 0–2 counters of look-ahead and never updates the counter automatically. Wider windows reduce strictness. Clocks must be reasonably synchronized; no network time service is used.
Transfer otpauth URIs carefully.
The local otpauth URI contains the secret, type, algorithm, digits and period or counter. Issuer and account labels support Unicode but no colons or control characters. QR generation is omitted to avoid another dependency. The URI is text, never navigation. Authenticator applications vary in support for non-default algorithms, digits and periods.
Know the security boundary.
Anyone with the OTP secret can generate valid codes. TOTP is not encryption. This tool neither creates accounts nor verifies against a live account. It does not enforce single-use replay prevention, server rate limits or account authorization. All in-range candidates are checked without early success exit, but JavaScript cannot guarantee constant-time execution. Reset and navigation clear local state; copying places the chosen content on your system clipboard. Browser memory cannot be guaranteed securely erased.