OTP Code Generator

HOTP (HMAC-based One-Time Password) uses a counter that increments with each authentication attempt, while TOTP (Time-based One-Time Password) uses the current time as the counter. TOTP codes expire after a short period (usually 30 seconds), making them more secure for automated systems. HOTP codes remain valid until used, which can be useful in offline scenarios.

If your authenticator app shows different codes, the most common cause is a time sync issue. TOTP relies on accurate time keeping, so ensure your device's clock is synchronized via NTP (Network Time Protocol). Another possibility is that you entered the wrong Base32 secret verify the secret matches exactly including any trailing padding characters.

Yes, all processing happens entirely in your browser using JavaScript. Your TOTP secret and generated codes are never sent to any server. The HMAC-SHA1 computation runs locally through the crypto-js library, and the QR code is generated client-side using the qrcode.react library. For production use, always keep your TOTP secret confidential and never share it with untrusted parties.

Base32 is an encoding scheme that uses 32 characters (A-Z and 2-7) to represent binary data in a human-readable format. TOTP uses Base32-encoded secrets because the alphabet avoids ambiguous characters like 0, 1, 8, and 9 that could be confused with letters. This makes manual entry of secrets more reliable and reduces errors when setting up authenticator apps.

Yes, this tool generates standard TOTP codes that are fully compatible with any RFC 6238-compliant authenticator app including Google Authenticator, Authy, Microsoft Authenticator, and LastPass Authenticator. The generated QR code contains the standard otpauth:// URI format that all major authenticator apps can scan and import automatically.