⏱️ TOTP / HOTP

Generate one-time codes from a secret.

Secret (base32) or otpauth:// URI

Type Algorithm Digits Period (s)

New secret

Issuer Account

How it works

HOTP (RFC 4226) computes HMAC(secret, counter), picks 4 bytes at an offset given by the last nibble, and keeps the last N decimal digits. TOTP (RFC 6238) uses the number of periods since the Unix epoch as the counter, so authenticator apps and servers agree as long as their clocks do. Most apps only support SHA-1, 6 digits and 30 seconds.