2FA / TOTP QR Generator & Validator

Generate a TOTP secret and QR code, and verify codes — without the secret leaving your browser.

······

0s until it changes

Secret (Base32)

Issuer

Account

Check a code from your app

Result

Generating

The secret is the entire second factor, so everything here happens in your browser: RFC 6238 is implemented directly rather than pulled from a library, and the QR code is drawn locally rather than handed to a QR image service — which is what most generators do, and which puts a second-factor secret into somebody else's server logs. Codes are derived from the current time divided into 30-second steps, which is why a device clock that is wrong breaks TOTP outright rather than degrading gracefully. Verification accepts the adjacent step in each direction, the standard allowance for skew and for the seconds between reading a code and submitting it.

Diagnostic telemetry

AlgorithmSHA-1 is the default every authenticator app supports. HMAC does not rely on collision resistance, so this is not the weakness it looks like.: TOTP / HMAC-SHA-1
Digits and period: 6 digits, 30s
Secret length: 0 Base32 characters
Secret transmittedGenerated, encoded and drawn as a QR entirely in this tab — including the QR, which is not handed to any image service.: Never

What this cannot tell you

The secret is the entire second factor. It is generated, encoded and drawn as a QR code in this tab, and the QR is rendered locally rather than handed to an image service — which is what most generators do, and which puts the secret into somebody else's server logs.
TOTP depends on the clock. Codes come from the current time divided into steps, so a device more than a step out generates codes for the wrong window and authentication fails outright rather than degrading.
Verification accepts the adjacent step in each direction, the standard allowance for skew. Consistently matching a non-zero offset means a clock is genuinely drifting.
RFC 6238 is implemented directly here rather than pulled from a library, so that fewer things sit in the path of a secret.
Everything happens in your browser. Nothing is transmitted, nothing is stored, and this page has no server side at all.
Ad-free by requirement, not by choice. A page handling secrets does not carry third-party scripts in the same document, and the boundary scanner enforces it.

Take this with you

This tool never saves runs. What it handles should not be written to disk — not even your own.

How this works

A twenty-byte random secret is generated with crypto.getRandomValues and encoded as Base32, which is what authenticator apps expect. The otpauth URI is assembled and rendered to a QR code in the page. Codes are derived by RFC 6238: the current Unix time is divided into thirty-second steps, that step counter is HMAC'd with the secret, and a truncation defined by RFC 4226 turns the result into six digits. That the counter comes from time alone is why a wrong device clock breaks TOTP completely — there is no negotiation, both sides simply compute from their own clock and compare. Verification here accepts one step either side, which is the standard allowance for skew and for the seconds between reading a code and typing it.

What the results mean

Secret: The whole credential. Anyone holding it can generate your codes indefinitely.
Current code: Derived from the time step and the secret. Changes every thirty seconds.
Valid, adjacent step: Accepted from the window before or after — normal skew allowance. Consistently non-zero means a clock is drifting.
HMAC-SHA1: The default every authenticator supports. HMAC does not rely on collision resistance, so SHA-1 here is not the weakness it appears.

Common problems and fixes

My app's codes are rejected everywhere: Almost always clock drift on the phone. Enable automatic time in the device settings; TOTP has no tolerance for a clock that is minutes out.
Can I use this secret for a real account?: Only enrol a secret a service gave you. A secret generated here is for testing your setup, and it is not registered with anything.
Where is the QR sent?: Nowhere. It is drawn in this tab. That is worth checking on any TOTP page you use — many pass the secret to a QR image API.

Frequently asked questions

Why does my authenticator app stop working when my clock is wrong?

Because TOTP derives the code from the current time. Both sides compute independently from their own clocks with no negotiation, so a device a minute out generates codes for a different window entirely.

Is HMAC-SHA1 safe for TOTP?

Yes. SHA-1 is broken for collision resistance, and HMAC does not depend on that property — its security rests on the key. It remains the default because every authenticator app supports it.

Does my secret leave the browser?

No. It is generated, encoded, turned into a QR code and used to compute codes entirely in this tab. The QR in particular is drawn locally rather than fetched from an image service.

Put this on your own site

Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.

Embed code

<iframe src="https://runthetests.com/embed/totp-qr-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="2FA / TOTP QR Generator & Validator" loading="lazy"></iframe>

Preview it at https://runthetests.com/embed/totp-qr-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.