OTP Generator: Generate TOTP and HOTP One-Time Passwords Online

What Are TOTP and HOTP?

HOTP (HMAC-based One-Time Password, RFC 4226) generates codes by computing HMAC-SHA1 of a shared secret and a counter value, then truncating the result to a 6- or 8-digit decimal number. The server and client both maintain a synchronized counter. After each successful authentication, both increment the counter. Because the counter is the moving factor, HOTP codes do not expire until used.

TOTP (Time-based One-Time Password, RFC 6238) extends HOTP by replacing the counter with the current Unix timestamp divided by a time step (typically 30 seconds). Both the client and server independently compute the same code because they use the same time. Codes automatically expire after 30 seconds. TOTP is the algorithm behind virtually all modern authenticator apps.

Both algorithms require a shared secret key, typically encoded in Base32 and presented as a QR code when setting up 2FA. The secret must be securely stored on both the server and the authenticator device. If the secret is compromised, an attacker can generate valid OTPs indefinitely, so protecting the secret is as important as protecting the OTP codes themselves.

How to Use This Tool

Generate OTP codes for testing by providing a shared secret.

1. 1

   Enter the secret key

   Paste the Base32-encoded shared secret into the Secret field. This is the same secret used to set up the authenticator app — found when you scan a QR code during 2FA enrollment. For testing, you can also enter any Base32 string.

2. 2

   Select the OTP type

   Choose TOTP (time-based, refreshes every 30 seconds) or HOTP (counter-based, increments with each generation). For 2FA testing, TOTP is the most common type.

3. 3

   Configure algorithm settings

   Set the number of digits (6 is standard, 8 is used by some enterprise systems), the time step in seconds for TOTP (default 30), or the counter value for HOTP. The hash algorithm is SHA-1 by default (per RFC standard), with SHA-256 and SHA-512 available for non-standard implementations.

4. 4

   Generate the OTP

   Click Generate to compute the current OTP. For TOTP, the tool also shows a countdown to the next code change. For HOTP, click Generate each time you need a new code — it increments the counter.

5. 5

   Compare with your authenticator

   Compare the generated code against what your authenticator app shows for the same secret. If they match, your secret is correctly configured. If they differ, verify the secret encoding, time synchronization, and algorithm settings.

Common Use Cases

OTP generation tools are essential for authentication development and testing.

• Testing TOTP/HOTP integration in authentication systems by verifying that generated codes match those produced by reference implementations and authenticator apps.
• Debugging 2FA setup flows where the QR code or secret key must be verified before showing it to users.
• Emergency access to accounts when an authenticator app device is lost — if you have the backup secret key, this tool can generate valid codes.
• Validating server-side OTP verification code by generating a known code and confirming the server accepts or rejects it correctly.
• Learning about OTP algorithms and understanding how time-based codes work as part of security education.

Tips and Best Practices

Implement OTP correctly for robust two-factor authentication.

• Store OTP secrets encrypted at rest on your server. Use envelope encryption: encrypt the secret with a data encryption key (DEK) that is itself encrypted with a key encryption key (KEK) stored in a hardware security module or secrets manager.
• Allow a time window of ±1 step (30 seconds before and after) on your server when validating TOTP codes to account for client-server clock drift, but no more.
• Track used HOTP/TOTP codes server-side and reject reuse of codes within their validity window to prevent replay attacks.
• Provide backup codes (static single-use codes) when users enroll in 2FA, so they can recover access if they lose their authenticator device.
• Encourage users to back up their OTP secrets (e.g., by scanning the QR code to a second device or saving the Base32 secret securely) to prevent lockout.

Security Considerations

TOTP codes are only as secure as the shared secret. If the secret is transmitted insecurely during enrollment (e.g., over HTTP), captured by a compromised device, or stored unencrypted in a database, an attacker can generate unlimited valid codes. The enrollment QR code must be scanned on a trusted device and never shared further.

OTP provides second-factor authentication — it is meaningful only when combined with a first factor (password). OTP alone is not authentication. Additionally, TOTP does not protect against real-time phishing attacks where an attacker captures the code and uses it within the 30-second window. Hardware security keys (FIDO2/WebAuthn) are phishing-resistant and provide stronger protection where available.

Frequently Asked Questions