Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Security

TOTP / HOTP Offline Code Generator

· Last updated：2026-06-22

Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy

Details

What this tool helps you do

Enter the base32 shared secret (as shown next to a QR code in Google Authenticator / Authy) and the tool computes one-time passwords locally — nothing is sent to any server.

Supported:

  • TOTP (RFC 6238): time-based codes derived from the current UNIX time and a step (30s or 60s). This is what Google Authenticator shows for most 2FA accounts.
  • HOTP (RFC 4226): counter-based codes derived from a shared counter value.
  • HMAC algorithms: SHA-1 (the RFC default, used by virtually every authenticator app), SHA-256, SHA-512.
  • 6-digit (default) or 8-digit output.
  • "Show next N codes" — preview the next several TOTP windows or HOTP counters, useful for testing drift.
  • Export an otpauth:// URI (with optional issuer + account label) so the account can be re-imported into any authenticator app.

Implementation notes:

  • HOTP uses the standard dynamic-truncation algorithm: HMAC the 8-byte big-endian counter, take the low 4 bits of the last byte as offset, extract a 31-bit integer, then mod 10^digits.
  • TOTP is HOTP with counter = floor(unixTime / step).
  • Secret decoding is RFC 4648 base32 (no padding required). Spaces are ignored so pasted secrets with separators still work.

Use cases: verifying your 2FA seed produces the same code as a phone, building TOTP verification into a login flow, teaching HMAC-based OTP, or migrating a 2FA account to a new device via otpauth://.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team
Code Generator9

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Security
Input types
text, select, number
Output type
html
Sample coverage
4
API ready
Yes

Overview

The TOTP / HOTP Offline Code Generator is a secure, local utility that generates RFC 6238 time-based and RFC 4226 counter-based one-time passwords directly from a base32 shared secret. Operating entirely in your browser without sending data to external servers, it supports HMAC-SHA1, SHA-256, and SHA-512 algorithms, outputs 6 or 8-digit codes, and generates standard otpauth:// URIs for easy import into authenticator apps like Google Authenticator or Authy.

When to use

  • When you need to verify that a raw 2FA base32 seed generates the correct one-time password without using a mobile device.
  • When migrating 2FA accounts to a new authenticator app by generating a standard otpauth:// URI from a raw secret.
  • When testing or debugging custom TOTP/HOTP authentication flows during software development.

How it works

  1. 1The tool decodes the provided base32 shared secret locally, ignoring any spaces or formatting characters.
  2. 2It computes the current time-step counter for TOTP or uses the specified counter value for HOTP.
  3. 3It applies the selected HMAC algorithm (SHA-1, SHA-256, or SHA-512) and performs dynamic truncation to extract the 6 or 8-digit code.
  4. 4It renders the active code, a real-time countdown, a preview of upcoming codes, and a formatted otpauth:// URI.

Use cases

  • Verifying the validity of a backup 2FA seed before storing it securely.
  • Generating a batch of future codes to test clock drift handling in a backend authentication system.
  • Creating custom QR codes or import links for team members using the generated otpauth:// URI.

Examples

1. Verifying a Standard 2FA Secret

Security Administrator

Background

An administrator needs to verify that a newly generated backup seed matches the codes generated by a user's hardware token.

Problem

Confirming the seed is correct without registering it on a physical phone.

How to use

Enter the base32 secret, select TOTP mode, choose SHA-1, set digits to 6, and check the generated code against the token.

Secret: JBSWY3DPEHPK3PXP, Mode: TOTP, Algorithm: SHA-1, Digits: 6, Period: 30

Outcome

The tool displays the current 6-digit code and a countdown, confirming the seed generates the expected values.

2. Creating an Import URI for a Custom Account

DevOps Engineer

Background

An engineer wants to distribute a shared 2FA credential to team members for a staging environment.

Problem

Generating a standard URI that team members can scan or copy into their authenticator apps.

How to use

Input the shared secret, enter the issuer name and account email, and copy the generated otpauth:// URI.

FAQ

Is my shared secret sent to a server?

No. All calculations are performed locally in your browser, ensuring your 2FA secrets remain completely private.

Which authenticator apps support the generated otpauth URI?

Most major authenticator apps, including Google Authenticator, Authy, Microsoft Authenticator, and 1Password, support it.

What is the difference between TOTP and HOTP?

TOTP generates codes based on the current time (e.g., changing every 30 seconds), while HOTP generates codes based on an incrementing counter.

Can I use secrets that contain spaces?

Yes. The generator automatically ignores spaces and formatting characters when decoding the base32 secret.

Why does the generated code not match my app?

Ensure your system clock is synchronized, and verify that the algorithm (usually SHA-1), digits (usually 6), and period (usually 30s) match your provider's settings.

Hub

Authorized JWT, OTP, TOTP, and Session Test Workflow

Build sanitized auth fixtures, separate token generation from decoding and verification, test OTP/TOTP timing, and audit JWT and session evidence without exposing real secrets.

Home
Tools3201
Samples593
Visualizations465
Viewers103
Hubs233
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance644

Calculators, numerics, date logic, statistics, and finance tools

Design & Color297

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff
Stripe Promo Code Batch Review and Import Preflight
Batch Photo Culling Review and Editing Shortlist Handoff
UI Screenshot Structure Review and Development Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
Media

QR Code Samples

Sample QR code images for testing QR code reading and generation tools

Code Processing

Code Comment Samples

Sample code files with various comment styles for testing comment removal

Python

Web Image Processing Python Samples

Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion

Code Quality

Invalid Variable Names Code Samples

Sample code files demonstrating invalid variable naming conventions across different programming languages

Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

Security

BIP39 Mnemonic Phrase Generator

Generate or validate 12 to 24 word BIP39 mnemonic phrases with entropy and PBKDF2-HMAC-SHA512 seed output

Games

Kakuro / Fillomino / Masyu / Yajilin / Hashiwokakero / Nurikabe / Slitherlink / Star Battle Puzzle Generator with Uniqueness Prover

Deterministically seeded generator for eight Nikoli logic-puzzle families — each board is grown solution-first, rendered as puzzle + solution SVGs, and verified by an exhaustive backtracking solver that counts solutions to two, so “unique” is a proof (and an exhausted budget is reported as unproven, never guessed).

Development

OAuth 2.0 / OIDC Authorization Code with PKCE Flow Visualizer

Simulate the Authorization Code flow with PKCE end to end: verifier/challenge generation, authorization URL, token exchange, ID Token validation checklist and an interception-attack demo.

Secret: JBSWY3DPEHPK3PXP, Issuer: StagingEnv, Account: [email protected]

Outcome

An otpauth://totp/StagingEnv:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=StagingEnv URI is generated for instant import.