TOTP Secret Generator
Create the shared secret behind a six-digit authenticator code, with a QR code any authenticator app can scan. Both are made on your device and never leave your browser.
A TOTP secret is the one value shared between a service and an authenticator app. Both sides run the same clock through it, which is where the rotating six digits come from. Add the account details below and a code appears that any authenticator app can scan.
Your TOTP secret
Strength: Strong, 160 bits
Scan to enrol
Add the service and the account name below, and a scannable code will appear here.
Customize
Shown as the heading in the authenticator app. This is only a label — it changes the code above, never the secret.
Shown under the service, so one app can hold several accounts with the same provider. A colon is not allowed here and is removed automatically.
The only setting that affects strength. 20 bytes is what RFC 4226 recommends and what every authenticator app is guaranteed to accept; a few older services only read the first 20, so raise it only if yours asks you to.
Characters used
ABCDEFGHIJKLMNOPQRSTUVWXYZ234567
Base32, the one encoding every authenticator app reads. It leaves out 0, 1 and 8 on purpose, so nobody typing a secret by hand has to decide whether that was an O or a zero.
Secret length
Worth checking against the field you are pasting it into — some setup forms cap it — but never a reason to drop below what the service asks for.
Recent secrets
Nothing here yet. Secrets you generate are kept on this device only, so you can pick one up again if you close the tab before finishing the setup.
How a six-digit code works
There is no message passing between your phone and the server. Both hold the same secret, both look at the clock, and both do the same arithmetic with the two — the current 30-second window, run through the secret, cut down to 6 digits. Matching codes mean matching secrets, which is the whole proof. It is also why a phone with a badly wrong clock stops working: nothing is broken, the two sides are simply in different windows.
Everything about that arithmetic is public except the secret. The algorithm, the digit count and the window are all written in the QR code you are about to scan, so the secret is carrying the entire burden. 20 bytes drawn from chance is 160 bits of it — enough that nobody works backwards from a code they saw, which is exactly what a secret built from an account id or an email address would allow.
The QR code is a convenience, not a security feature. It holds the same secret in plain text, which means a screenshot of it is the second factor: anyone who ends up with that image can enrol their own authenticator and produce valid codes for as long as the secret lives. Scan it, confirm the first code works, and then get rid of the picture.
A second factor is only as good as the way back in when it is gone. Phones are lost, wiped and replaced, and a TOTP secret that lived only on one of them goes with it. Store backup codes somewhere separate before you rely on this, or keep the secret itself in a password manager that is not on the same device.
Nothing here is enrolled with anyone. This page draws a secret and writes the setup code around it; it becomes real only once you give it to a service and scan it into an app.
Everything happens on your device. Your TOTP secrets never leave this browser.