OTP Generator & Validator
Generate and validate TOTP/HOTP one-time passwords for 2FA. Supports SHA-1/256/512, Base32/Hex secrets, QR code export. 100% browser-based, no signup.
What is an OTP (One-Time Password)?
An OTP is a password that is valid for only one login session or transaction. It provides stronger security than static passwords because it changes frequently, making stolen codes useless after a short time.
What is the difference between TOTP and HOTP?
TOTP (Time-based One-Time Password, RFC 6238) generates codes based on the current time, changing every 30 seconds by default. HOTP (HMAC-based One-Time Password, RFC 4226) uses an incrementing counter that advances each time a code is generated. TOTP is more common in modern 2FA systems.
Is this OTP generator safe to use?
Yes. All generation and validation happens locally in your browser using the Web Crypto API. Your secret keys never leave your device or get sent to any server.
What is a Base32 secret?
Base32 is an encoding scheme that represents binary data using 32 characters (A-Z and 2-7). It is the standard format for OTP secrets used by Google Authenticator and other 2FA apps, e.g. "JBSWY3DPEHPK3PXP".
Which hash algorithm should I choose?
SHA-1 is the default and is compatible with most authenticator apps including Google Authenticator. SHA-256 and SHA-512 offer stronger security but may not be supported by all apps. Use SHA-1 for maximum compatibility.
How do I add the generated code to Google Authenticator?
Enter your secret, then scan the displayed otpauth QR code with Google Authenticator (or any compatible 2FA app). You can also manually enter the otpauth URI or the secret key.
What is the otpauth:// URI format?
otpauth://totp/<label>?secret=<secret>&issuer=<issuer>&algorithm=<algo>&digits=<digits>&period=<period>. This URI encodes all OTP parameters and can be rendered as a QR code for easy import into authenticator apps.
Why does the code change every 30 seconds?
The default time step (period) for TOTP is 30 seconds as defined in RFC 6238. This balances security (short validity) with usability (enough time to type the code). You can customize the period if needed.
Can I validate a code I received?
Yes, switch to the Validate mode, enter the secret and the code you received. The tool checks the code against the current and adjacent time windows to tolerate minor clock differences.
What does 6-digit vs 8-digit mean?
It refers to the length of the generated OTP code. 6 digits is the standard for most 2FA systems. 8 digits provides more possible combinations but is less commonly supported.
Why are my codes not matching Google Authenticator?
Check that the secret, algorithm (usually SHA-1), digits (usually 6), and period (usually 30s) all match. Also ensure your device clock is accurate, as TOTP relies on time synchronization.
Is 2FA the same as OTP?
OTP is the mechanism that generates one-time codes. 2FA (Two-Factor Authentication) is a security process that often uses OTP as the second factor, combining something you know (password) with something you have (OTP device).