2FA / TOTP QR Generator & Validator

Generate a TOTP secret and QR code, and verify codes — without the secret leaving your browser.

······

0s until it changes

Secret (Base32)

Issuer

Account

Check a code from your app

Result

Generating

The secret is the entire second factor, so everything here happens in your browser: RFC 6238 is implemented directly rather than pulled from a library, and the QR code is drawn locally rather than handed to a QR image service — which is what most generators do, and which puts a second-factor secret into somebody else's server logs. Codes are derived from the current time divided into 30-second steps, which is why a device clock that is wrong breaks TOTP outright rather than degrading gracefully. Verification accepts the adjacent step in each direction, the standard allowance for skew and for the seconds between reading a code and submitting it.

Diagnostic telemetry
AlgorithmSHA-1 is the default every authenticator app supports. HMAC does not rely on collision resistance, so this is not the weakness it looks like.
TOTP / HMAC-SHA-1
Digits and period
6 digits, 30s
Secret length
0 Base32 characters
Secret transmittedGenerated, encoded and drawn as a QR entirely in this tab — including the QR, which is not handed to any image service.
Never

What this cannot tell you

  • The secret is the entire second factor. It is generated, encoded and drawn as a QR code in this tab, and the QR is rendered locally rather than handed to an image service — which is what most generators do, and which puts the secret into somebody else's server logs.
  • TOTP depends on the clock. Codes come from the current time divided into steps, so a device more than a step out generates codes for the wrong window and authentication fails outright rather than degrading.
  • Verification accepts the adjacent step in each direction, the standard allowance for skew. Consistently matching a non-zero offset means a clock is genuinely drifting.
  • RFC 6238 is implemented directly here rather than pulled from a library, so that fewer things sit in the path of a secret.
  • Everything happens in your browser. Nothing is transmitted, nothing is stored, and this page has no server side at all.
  • Ad-free by requirement, not by choice. A page handling secrets does not carry third-party scripts in the same document, and the boundary scanner enforces it.

Take this with you

This tool never saves runs. What it handles should not be written to disk — not even your own.

2FA / TOTP QR Generator & Validator on RunTheTests — free browser-based security tools, no sign-up.