Question 1

What is TOTP and how does it differ from HOTP?

Accepted Answer

**TOTP** (Time-Based One-Time Password, RFC 6238) generates codes that change every 30 seconds. Both server and client know the secret; both compute HMAC(secret, current_time / 30). Same time + same secret = same code. **HOTP** (HMAC-Based, RFC 4226) is event-counter based instead, codes change every time you press the button. TOTP won the 2FA space because time-sync is more reliable than counter-sync (no 'what if I generated a code but didn't use it' edge cases). Both are open standards, both work with the same `otpauth://` URI scheme.

Question 2

What's a Base32 secret and why that format?

Accepted Answer

TOTP secrets are random bytes (typically 20 bytes / 160 bits for SHA1, longer for SHA256/512). They're encoded as Base32 in the `otpauth://` URI because Base32 uses only A-Z and 2-7, no lowercase, no ambiguous characters (0/O, 1/I/L), making secrets reliably typeable and readable when QR scanning isn't possible. Google Authenticator only accepts Base32; some apps accept hex too, but Base32 is the universal standard.

Question 3

SHA1, SHA256, or SHA512?

Accepted Answer

RFC 6238 specifies SHA1 as the default, and that's what 99% of services use (Google, GitHub, AWS, most banks). SHA256 and SHA512 are supported by the spec but **not by Google Authenticator**, using them means users get cryptic errors when scanning. Authy, 1Password, Bitwarden, and most modern apps handle all three. The cryptographic difference doesn't matter, SHA1 in HMAC mode (which is what TOTP uses) has no known practical attacks. Stick with SHA1 for compatibility unless you have a specific reason.

Question 4

What does the otpauth:// URI contain?

Accepted Answer

Everything an authenticator app needs to add the account: `otpauth://totp/Issuer:account@example.com?secret=BASE32SECRET&issuer=Issuer&algorithm=SHA1&digits=6&period=30`. The path encodes the label (often `Issuer:account`); query parameters set algorithm, digits, period. Scanning the QR (which encodes this URI) auto-fills all of it. Typing it manually works but is tedious, that's the whole point of the QR.

Question 5

Is this safe for real 2FA setup?

Accepted Answer

Yes, the secret is generated and the URI/QR are constructed entirely in your browser. The secret never leaves the tab. That said: for production 2FA setup, the better pattern is your auth provider generates the secret server-side, hands it to the user once (via a QR), and verifies the user typed back a correct code before activating. Generating the secret in a third-party tool means trusting that tool's randomness and trusting its claim of not transmitting. Use this generator for debugging, dev environments, and learning, not for setting up 2FA on your bank account.

Question 6

Is the secret transmitted anywhere?

Accepted Answer

No. Secret generation uses `crypto.getRandomValues` (the Web Crypto API). Base32 encoding, URI construction, and QR code rendering all happen in your browser. Open DevTools Network during use: zero outbound requests. The secret exists only as a string in your tab's memory until you close the page.

Question 7

What standards does OTP / TOTP QR Generator validate against?

Accepted Answer

OTP / TOTP QR Generator checks compliance with RFC 6238 (TOTP), RFC 4226 (HOTP), RFC 4226 (HMAC).

Question 8

What are the limitations of OTP / TOTP QR Generator?

Accepted Answer

Time-based codes require device clock to be synchronized within 30s window Does not persist secrets, keys are lost on page refresh SHA-1 only, some services require SHA-256/512 TOTP QR code generation requires clipboard or manual entry

Algorithm	Hash Bits	Compatibility	Security Profile
SHA1	160-bit	Universal (Recommended)	Standard
SHA256	256-bit	Authy, 1Password, Bitwarden	Enhanced
SHA512	512-bit	Modern authenticators only	Maximum

OTP / TOTP QR Generator

Authenticator Details

Advanced Options

Scan with Authenticator

Live Test Code

Privacy note

How to Use OTP / TOTP QR Generator

Enter Secret Key

View Current OTP

Copy Code

OTP / TOTP QR Generator: the essentials

Key points

Learn More

How TOTP 2FA Actually Works (and How to Test It Without Your Phone)

AES Interoperability Across 7 Libraries: We Encrypted the Same Plaintext Everywhere and Compared Results

Base64 Encoding: When You Should and Shouldn't Use It (2026 Guide)

What is OTP / TOTP QR Generator?

Frequently Asked Questions

Technical Deep Dive

OTP / TOTP QR Generator

Cryptographically Sound

Stays in Your Browser

Tunable & Inspectable

01 Algorithm Compatibility Matrix

02 TOTP Provisioning Workflow

Runs 100% in your browser

You Might Also Need

Bcrypt Hash Generator

Certificate Decoder (X.509 PEM)

CSP Builder

Data Anonymizer & PII Masker