# TOTP / HOTP Offline Code Generator Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy > Canonical page: https://elysiatools.com/en/tools/totp-hotp-offline-generator - **Category:** Security - **Keywords:** totp, hotp, otp, one-time password, 2fa, two-factor, rfc 6238, rfc 4226, google authenticator, authy, hmac, base32, security ## Overview Enter the base32 shared secret (as shown next to a QR code in Google Authenticator / Authy) and the tool computes one-time passwords locally — nothing is sent to any server. Supported: - **TOTP** (RFC 6238): time-based codes derived from the current UNIX time and a step (30s or 60s). This is what Google Authenticator shows for most 2FA accounts. - **HOTP** (RFC 4226): counter-based codes derived from a shared counter value. - HMAC algorithms: **SHA-1** (the RFC default, used by virtually every authenticator app), **SHA-256**, **SHA-512**. - 6-digit (default) or 8-digit output. - "Show next N codes" — preview the next several TOTP windows or HOTP counters, useful for testing drift. - Export an **otpauth://** URI (with optional issuer + account label) so the account can be re-imported into any authenticator app. Implementation notes: - HOTP uses the standard dynamic-truncation algorithm: HMAC the 8-byte big-endian counter, take the low 4 bits of the last byte as offset, extract a 31-bit integer, then mod 10^digits. - TOTP is HOTP with counter = floor(unixTime / step). - Secret decoding is RFC 4648 base32 (no padding required). Spaces are ignored so pasted secrets with separators still work. Use cases: verifying your 2FA seed produces the same code as a phone, building TOTP verification into a login flow, teaching HMAC-based OTP, or migrating a 2FA account to a new device via otpauth://. ## Inputs - **Shared Secret (base32)** (text): JBSWY3DPEHPK3PXP (A–Z, 2–7; spaces ignored) - **Mode** (select) - **HMAC algorithm** (select) - **Digits** (select) - **Time step (seconds)** (select) - **Counter (HOTP)** (number): e.g. 0 - **Show next N codes** (number) - **Issuer (for otpauth URI)** (text): e.g. Acme Corp - **Account label** (text): e.g. alice@example.com ## When to use - When you need to verify that a raw 2FA base32 seed generates the correct one-time password without using a mobile device. - When migrating 2FA accounts to a new authenticator app by generating a standard otpauth:// URI from a raw secret. - When testing or debugging custom TOTP/HOTP authentication flows during software development. ## How it works - The tool decodes the provided base32 shared secret locally, ignoring any spaces or formatting characters. - It computes the current time-step counter for TOTP or uses the specified counter value for HOTP. - It applies the selected HMAC algorithm (SHA-1, SHA-256, or SHA-512) and performs dynamic truncation to extract the 6 or 8-digit code. - It renders the active code, a real-time countdown, a preview of upcoming codes, and a formatted otpauth:// URI. ## Use cases - Verifying the validity of a backup 2FA seed before storing it securely. - Generating a batch of future codes to test clock drift handling in a backend authentication system. - Creating custom QR codes or import links for team members using the generated otpauth:// URI. ## Frequently asked questions ### Is my shared secret sent to a server? No. All calculations are performed locally in your browser, ensuring your 2FA secrets remain completely private. ### Which authenticator apps support the generated otpauth URI? Most major authenticator apps, including Google Authenticator, Authy, Microsoft Authenticator, and 1Password, support it. ### What is the difference between TOTP and HOTP? TOTP generates codes based on the current time (e.g., changing every 30 seconds), while HOTP generates codes based on an incrementing counter. ### Can I use secrets that contain spaces? Yes. The generator automatically ignores spaces and formatting characters when decoding the base32 secret. ### Why does the generated code not match my app? Ensure your system clock is synchronized, and verify that the algorithm (usually SHA-1), digits (usually 6), and period (usually 30s) match your provider's settings. ## Related tools - [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification. - [BIP39 Mnemonic Phrase Generator](https://elysiatools.com/en/tools/mnemonic-bip39-generator): Generate or validate 12 to 24 word BIP39 mnemonic phrases with entropy and PBKDF2-HMAC-SHA512 seed output - [Barcode Batch Generator](https://elysiatools.com/en/tools/barcode-batch-generator): Batch generate Code 128, EAN-13, UPC-A, ITF-14, QR Code, and Data Matrix outputs from CSV or multiline text - [Bcrypt Generator](https://elysiatools.com/en/tools/bcrypt-generator): Generate bcrypt hash from password - [Geohash Generator](https://elysiatools.com/en/tools/geohash-generator): Generate geohash from latitude and longitude coordinates - [HMAC Generator & Verifier](https://elysiatools.com/en/tools/hmac-generator-verifier): Compute an HMAC message-authentication signature over a message + shared secret using SHA-1/SHA-2/SHA-3/BLAKE2, or verify an incoming signature against the secret — with webhook presets for Stripe / Slack / GitHub and constant-time comparison - [Markdown Table Generator](https://elysiatools.com/en/tools/markdown-table-generator): Generate formatted Markdown tables from CSV, JSON, or array data with alignment, header styles, width control, and merge hints - [RSA Encrypt / Decrypt](https://elysiatools.com/en/tools/rsa-encrypt-decrypt): Encrypt text with an RSA public key or decrypt ciphertext with the matching private key, using OAEP padding (SHA-1 or SHA-256). Handles long messages by chunking. Keys and data stay local. PKCS#1 v1.5 is intentionally not offered (Node disables it for decryption due to Bleichenbacher attacks). ## Samples - [QR Code Samples](https://elysiatools.com/en/samples/qrcode-samples): Sample QR code images for testing QR code reading and generation tools - [Code Comment Samples](https://elysiatools.com/en/samples/code-comment-samples): Sample code files with various comment styles for testing comment removal - [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion - [Invalid Variable Names Code Samples](https://elysiatools.com/en/samples/code-invalid-variable-names-samples): Sample code files demonstrating invalid variable naming conventions across different programming languages ## Related content - [Token, Session, and 2FA Workflow Tools](https://elysiatools.com/en/hubs/token-session-and-2fa-workflows): Debug real sign-in flows with PKCE and nonce generators, JWT and JWK inspectors, HMAC verification, OTP and TOTP testing, and auth-safe identifiers collected in one focused workflow hub. - [Audio Encoding and Format Conversion Tools](https://elysiatools.com/en/hubs/audio-convert): Compare audio format conversion, bitrate changes, sample-rate conversion, codec swaps, and export tools in one hub for delivery and archive workflows. - [Image Format Conversion and Animated Export Tools](https://elysiatools.com/en/hubs/image-convert): Compare image format converters for JPG, PNG, GIF, AVIF, WebP, TIFF, ICO, base64, and animation-friendly exports in one hub. - [JSON Interchange and Format Translation Tools](https://elysiatools.com/en/hubs/json-convert): Compare JSON conversion tools for CSV, YAML, TOML, GraphQL, XML, Markdown, Excel, BSON, EDN, and related structured formats in one hub.