What a TOTP secret is
Time-based one-time passwords (TOTP, RFC 6238) are the six-digit codes shown by apps like Google Authenticator, Microsoft Authenticator, 1Password and Authy. The server and the app share a secret key, and both compute a code from that key and the current 30-second time window.
This generator creates the shared secret in Base32, the format authenticator apps expect. The default 160-bit secret matches the recommendation in RFC 4226. Add an issuer and account name to build a setup QR code, and watch the live code to confirm your server and app agree.
For developers adding 2FA
- Generate the secret on your server when a user turns on 2FA, and store it encrypted.
- Show the QR code once, then ask for a code to confirm setup before switching 2FA on.
- Accept the previous and next time window to allow for clock drift.
- Offer backup codes so users are not locked out when they lose their phone.
Frequently asked questions
Is it safe to generate a real 2FA secret on a website?
This page creates the secret on your device and never sends it anywhere. For production 2FA, though, your own server should generate and store secrets. Use this tool for testing, prototypes and personal setups where you control both sides.
Why does my app show a different code?
Check that your device clock is set automatically. TOTP depends on both sides agreeing on the time, and a clock that is off by more than about 30 seconds produces different codes.