About TOTP 2FA Secret Key & QR Generator
TOTP (Time-based One-Time Password, defined in RFC 6238) is the algorithm behind most app-based two-factor authentication — Google Authenticator, Authy, 1Password, and similar apps all implement it the same way. A random secret key is generated and shared once (usually via QR code) between the server and the authenticator app; from then on, both sides can independently compute the same 6-digit code every 30 seconds, based on the shared secret and the current time, using HMAC-SHA1 as defined in the underlying HOTP algorithm (RFC 4226).
This tool generates a proper random secret, encodes it in Base32 (the standard format for TOTP secrets), builds the otpauth:// URI that authenticator apps expect, and renders it as a scannable QR code. It also computes and displays the exact live 6-digit code that any compliant authenticator app would show right now — useful for testing a login flow or an integration without needing a phone in hand. The underlying HOTP/TOTP math in this tool has been checked against the official test vectors published in RFC 4226 and RFC 6238.
This is intended for development, testing, and account setup — not for storing a production secret long-term in this browser tab. The secret is generated locally and never transmitted anywhere, but closing this page discards it permanently, exactly like scanning a real QR code once and then losing it.
Send Feedback
For any questions, bug reports, or feature requests, please use the form below to send us a message.