- How does TOTP two-factor authentication work?
- TOTP combines a shared secret key with the current time (divided into 30-second windows) using HMAC to generate a short-lived 6-digit code. Both the authenticator app and server compute the same code independently — if they match, login succeeds.
- Which authenticator apps are compatible with this tool?
- All TOTP-compatible apps: Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, FreeOTP, and any app that supports otpauth:// URIs and RFC 6238.
- Why does my authenticator show a different code than this tool?
- Common causes: clock drift (sync your device time via NTP), wrong secret key encoding, algorithm mismatch (SHA-1 vs SHA-256), different time period (30s vs 60s), or digit count mismatch (6 vs 8 digits).
- What is the difference between TOTP and HOTP?
- TOTP is time-based — codes change every 30 seconds. HOTP is counter-based — codes change only when the counter increments. TOTP is more common because it doesn't require counter synchronization between devices.
- Can I use this to set up 2FA for my own application?
- Yes. Generate a Base32 secret, create a QR code with the otpauth:// URI, let users scan it with their authenticator app, and verify codes on your server using a TOTP library (speakeasy for Node.js, pyotp for Python).
- Is TOTP secure enough for production authentication?
- Yes. TOTP is a proven standard used by Google, GitHub, AWS, and most major services. For highest security, combine TOTP with phishing-resistant methods like WebAuthn/passkeys as a primary factor.
- How do I generate an OTP QR code?
- Enter your service name and secret (or click 'generate random secret') above. The tool produces a QR code following the standard otpauth://totp/Issuer:account?secret=BASE32SECRET&issuer=Issuer URI format. Scan it with Google Authenticator, Authy, 1Password, Bitwarden, or any RFC 6238 TOTP authenticator. The same code can be entered manually if scanning isn't possible — useful for cross-device setup.
- Can I generate a TOTP QR code for Google Authenticator?
- Yes. The QR code uses the otpauth:// URI scheme that Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and Aegis all support. Just scan and the account is added. The tool defaults to 6-digit codes with a 30-second period (the standard Google uses), but you can change to 8 digits or 60-second period for compatibility with services that require those settings.
- What's the difference between HOTP and TOTP?
- HOTP (HMAC-based One-Time Password, RFC 4226) generates codes from a counter that increments each use — the server and client must stay in sync. TOTP (Time-based, RFC 6238) generates codes from the current Unix time divided by a period (usually 30 seconds) — no counter sync needed. Google Authenticator and most modern apps use TOTP. HOTP is rare today but still seen in hardware tokens (YubiKey OATH-HOTP mode).
- Is the secret stored anywhere?
- No. The secret generation and QR-code rendering both happen client-side in your browser. Nothing is sent to a server. The secret only leaves your browser when YOU choose to scan it into an authenticator app — which is encrypted at rest in that app. You can verify zero network calls in DevTools → Network.
- Why does Google Authenticator show 'Invalid code' even though the secret is correct?
- The #1 cause is device clock drift. Open Settings → Date & Time and enable 'Set automatically' (NTP sync). The #2 cause is algorithm mismatch — Google Authenticator only supports SHA-1 by default; if the service is using SHA-256 you'll get invalid-code errors even with the right secret. Use this tool's algorithm dropdown to confirm which one the service expects.
- What's the maximum 'safe' clock drift for TOTP?
- Most servers accept the current code plus the previous and next 30-second window (±1 step), giving ~60 seconds of drift tolerance. Some strict implementations only accept the current window (no tolerance). If you're consistently seeing rejected codes, your device clock is off by 30+ seconds — sync it via NTP.
- Can I export my Google Authenticator secrets to use here?
- Yes. Open Google Authenticator → menu → Transfer accounts → Export accounts. It produces a QR code containing an otpauth-migration:// URI with all your secrets. Decode that QR (you can use our QR Code Reader tool) to extract each Base32 secret, then paste it here. Useful when migrating from Google Authenticator to Authy, 1Password, or a hardware key.
- Is this tool RFC 6238 compliant?
- Yes. The generated codes match the official RFC 6238 reference test vectors exactly (you can verify with the standard test secret '12345678901234567890' and known timestamps). Compatible with every spec-compliant TOTP implementation: GitHub, AWS, Google, Microsoft, Cloudflare, and thousands of others.
