TOTP code generator

This is RFC 6238, the scheme behind every authenticator app. The secret is base32 text; the page decodes it to bytes, counts how many 30-second steps have passed since 1 January 1970 on this device's clock, and signs that count with HMAC using the browser's own crypto.subtle — SHA-1 unless the service asked for SHA-256 or SHA-512. Four bytes are picked out of the signature by the rule in RFC 4226 and cut down to six or eight digits. An otpauth://totp/… link, the text inside a setup QR code, is read whole: its secret, hash, digits, period and the issuer and account it names all set the page for you.

The secret is the second factor. Anyone who holds it can make your codes for as long as the account keeps it, so treat it like a password. This page makes no network requests and keeps nothing — close the tab and the secret is gone — but it is still text on a screen, readable by anything else running in this browser, extensions included. Use it to recover a code when your phone is out of reach, to check that a secret you saved is the right one, or to test a login you are building; keep the secret itself somewhere you would keep a password.

The code depends on the clock. If this device is more than about half a minute out, the codes will not match the service's, and no setting here fixes that — set the clock. Most services accept the code from one step either side, which is why a code that has just changed often still works. A secret shorter than 128 bits is accepted, since many services issue 80-bit ones, and the page names its length.

New secret is for building or testing a login of your own: it draws 160 bits from crypto.getRandomValues — the length RFC 4226 recommends — writes them as base32, and builds the setup link to go with it under the placeholder name Test. Turn that link into a QR code with the QR code page and scan it into an authenticator app, and the app and this page will show the same codes. A secret made here exists only in this tab until you copy it somewhere.