Is my shared secret sent to a server?

No. All calculations are performed locally in your browser, ensuring your 2FA secrets remain completely private.

Which authenticator apps support the generated otpauth URI?

Most major authenticator apps, including Google Authenticator, Authy, Microsoft Authenticator, and 1Password, support it.

What is the difference between TOTP and HOTP?

TOTP generates codes based on the current time (e.g., changing every 30 seconds), while HOTP generates codes based on an incrementing counter.

Can I use secrets that contain spaces?

Yes. The generator automatically ignores spaces and formatting characters when decoding the base32 secret.

Why does the generated code not match my app?

Ensure your system clock is synchronized, and verify that the algorithm (usually SHA-1), digits (usually 6), and period (usually 30s) match your provider's settings.

Elysia Tools

Navigation

Security

TOTP / HOTP Offline Code Generator

Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy

Details

What this tool helps you do

Enter the base32 shared secret (as shown next to a QR code in Google Authenticator / Authy) and the tool computes one-time passwords locally — nothing is sent to any server.

Supported:

TOTP (RFC 6238): time-based codes derived from the current UNIX time and a step (30s or 60s). This is what Google Authenticator shows for most 2FA accounts.
HOTP (RFC 4226): counter-based codes derived from a shared counter value.
HMAC algorithms: SHA-1 (the RFC default, used by virtually every authenticator app), SHA-256, SHA-512.
6-digit (default) or 8-digit output.
"Show next N codes" — preview the next several TOTP windows or HOTP counters, useful for testing drift.
Export an otpauth:// URI (with optional issuer + account label) so the account can be re-imported into any authenticator app.

Implementation notes:

HOTP uses the standard dynamic-truncation algorithm: HMAC the 8-byte big-endian counter, take the low 4 bits of the last byte as offset, extract a 31-bit integer, then mod 10^digits.
TOTP is HOTP with counter = floor(unixTime / step).
Secret decoding is RFC 4648 base32 (no padding required). Spaces are ignored so pasted secrets with separators still work.

Use cases: verifying your 2FA seed produces the same code as a phone, building TOTP verification into a login flow, teaching HMAC-based OTP, or migrating a 2FA account to a new device via otpauth://.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Prepared example runs

Click an example to fill the form automatically. File inputs still need an upload.

1 examples

Generate the current 6-digit TOTP for a known seed

Uses the classic RFC test seed JBSWY3DPEHPK3PXP with SHA-1, 6 digits, 30s step.

<div>Shows the current TOTP code, countdown ring, next 5 windows, and an otpauth:// URI.</div>

Inputs

Options are grouped so long tools stay easier to scan.

9 options

ContentPaste or type the main input values.3

Shared Secret (base32)textRequiredIssuer (for otpauth URI)textOptionalAccount labeltextOptional

SettingsAdjust formats, ranges, numbers, and modes.6

ModeselectOptionalHMAC algorithmselectOptionalDigitsselectOptionalTime step (seconds)selectOptionalCounter (HOTP)numberOptionalShow next N codesnumberOptional

Result

Ready for a run

Run the tool to preview files, text, structured data, or streamed output here.

Samples

TOTP / HOTP Offline Code Generator

What this tool helps you do

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Verifying a Standard 2FA Secret

2. Creating an Import URI for a Custom Account

FAQ

QR Code Samples

Code Comment Samples

Web Image Processing Python Samples

Invalid Variable Names Code Samples

PKCE Code Verifier & Challenge Generator

BIP39 Mnemonic Phrase Generator

Barcode Batch Generator

Bcrypt Generator

Token, Session, and 2FA Workflow Tools

Audio Encoding and Format Conversion Tools

Image Format Conversion and Animated Export Tools

JSON Interchange and Format Translation Tools