OTP Code Generator
Create time-based one-time passcodes from a shared secret locally.
OTP Code Generator
Runs entirely in your browser
This tool executes locally using standard browser APIs (for example window.crypto.getRandomValues or crypto.subtle where applicable). Your input is not transmitted to or stored on a ScriptPulse server. See How Calculations Work.
What This Tool Does
- The OTP Code Generator is a browser-first security utility designed to generate Time-based One-Time Passwords (TOTP) locally. Multi-factor authentication (MFA) uses one-time passcodes to verify user logins, combining a user password with a dynamic verification code. The TOTP algorithm (RFC 6238) computes passcodes from a shared secret key and the current time (typically in 30-second steps). The OTP Code Generator allows developers to generate local codes for testing integrations.
- The generator prioritizes absolute safety. Shared secrets, times, and passcodes are calculated in browser memory using local cryptographic engines. No data is sent to external servers, protecting your MFA configuration keys from exposure.
How It Works
- The tool reads the shared secret key (encoded in Base32) from the input field.
- It decodes the Base32 string into a raw byte array.
- The engine calculates the current time step counter using the browser's system clock.
- It computes an HMAC-SHA1 digest using the time step as the message and the secret byte array as the key.
- A dynamic truncation step extracts 4 bytes from the digest, calculates a numeric value, and outputs a 6-digit passcode.
Usage
- Enter your Base32-encoded shared secret key in the input field.
- The tool decodes the secret and calculates the 6-digit passcode in real time.
- Review the remaining seconds indicator before the passcode rotates.
- Copy the passcode to verify your login form integrations.
Examples
- Generating code from standard secret: Translating `JBSWY3DPEHPK3PXP` into a 6-digit passcode.
- Checking rotation intervals: Watching the passcode change every 30 seconds.
- Verifying credentials setups: Confirming that generated passcodes pass server validations.
- Testing sync issues: Reviewing passcode outputs under time variations.
Real-World Use Cases
- Testing backend MFA validation rules during login development by generating local passcodes.
- Validating shared secret keys during authentication configurations setups.
- Debugging TOTP synchronizations bugs on backend systems.
- Generating test tokens to check authenticator app configurations.
- Teaching multi-factor authentication principles in security classes.
Best Practices
- Keep shared secrets secure and rotate them if a credential leak is suspected.
- Configure time synchronization (NTP) on application servers to prevent verification failures.
- Ensure backend validation rules allow for a small window of previous/next steps to account for client clock drift.
- Store shared secrets in secure database environments.
Common Mistakes
- Entering invalid characters in the Base32 secret key: Base32 only permits letters A-Z and digits 2-7.
- Mismatched system clocks: if the server and client clocks are out of sync by more than a minute, generated codes will fail validation.
- Exposing the shared secret key in logs or commits, compromising MFA security.
- Pasting public key parameters assuming they correspond to Base32 secrets.
Limitations
- Calculations use the browser system clock; server times may differ based on configurations.
- Only supports the standard 6-digit SHA1 algorithm variation in the current UI.
- Data is processed in browser memory; reloading the page clears the workspace.
Technical Reference Guide
- RFC 6238: The official standard defining the Time-Based One-Time Password (TOTP) Algorithm.
- HMAC-SHA1: The hashing algorithm used to compute digests from the secret key and time step.
- Base32 Encoding: The standard alphanumeric format used to share MFA secrets.
FAQ
Is my secret key secure when generating codes?
Yes. All calculations are executed locally inside your browser memory using client-side JavaScript. No data is sent to external servers.
What is TOTP?
TOTP stands for Time-based One-Time Password. It generates dynamic passcodes by hashing a shared secret with the current time, rotating codes at fixed intervals.
How long is a TOTP code valid?
A standard TOTP code is valid for 30 seconds. Backend validators often allow a buffer of one step before/after to account for client clock drift.
What characters are allowed in a Base32 secret?
Base32 permits uppercase letters A-Z and numbers 2-7. Characters like 0, 1, 8, 9, and specific letters are excluded to prevent entry errors.
Why do generated codes fail on my server?
The most common reason is clock drift. If your server clock and client device clock differ by more than 30 seconds, validation will fail.
Can I use this to log in to my accounts?
If you have the shared secret key, you can generate codes here. However, using dedicated authenticator apps is recommended for personal accounts.
What is the difference between TOTP and HOTP?
TOTP uses the current time as the counter. HOTP uses a sequential event counter that increments on every code request.
Does the tool support 8-digit codes?
This utility calculates standard 6-digit codes. 8-digit variants require specific algorithm modifications.
Does this tool work offline?
Yes. Once the page is loaded, the page assets are cached, allowing you to use all tools without an active internet connection.
What happens if my secret key has padding (=)?
Standard Base32 padding is supported and parsed correctly by the local decoder.
How do I secure my shared secret keys?
Treat shared secrets like passwords. Store them in secure database tables and encrypt them at rest.
Is TOTP secure against phishing?
Standard TOTP can be phished if an attacker intercepts the code in real time. FIDO2/WebAuthn keys provide stronger phishing resistance.
Part of this Developer Hub
This utility is part of our comprehensive Authentication & Tokens Lab topic workspace.
Explore foundational guidelines, technical specifications, and other interactive utilities related to this workflow.
Related Tools
Explore related utilities inside the Security Lab workshop for complementary engineering workflows.
View all Security Lab tools