OTP Generator Online | TOTP & HOTP One-Time Password Browser Tool

This tool implements both TOTP (RFC 6238) and HOTP (RFC 4226) algorithms in a single interface. TOTP generates time-based codes fully compatible with Google Authenticator, Authy, and Microsoft Authenticator, while HOTP generates counter-based codes for services that require them. Choose SHA-1, SHA-256, or SHA-512 as the hash algorithm, 6, 7, or 8 digit output, and paste your Base32-encoded shared secret. The Previous/Next code window lets you debug clock-drift issues when the current code is rejected by the server. All computation uses the browser's Web Crypto API — your secret never leaves your device.

TOTP vs HOTP Comparison

Feature	TOTP (RFC 6238)	HOTP (RFC 4226)
Basis	Current time (15-60s window)	Counter (increments per use)
Code lifetime	30 seconds (default)	Until next use
Clock sync	Required (server + device)	Not needed
Compatible with	Google Authenticator, Authy, Microsoft	Hardware tokens, some banking APIs
Resync on missed code	Automatic (next time window)	Manual (counter must match)

Code Examples

// Browser — TOTP generation (SHA-1, 6 digits, 30s step)
const secret = base32Decode('JBSWY3DPEHPK3PXP');
const timeStep = Math.floor(Date.now() / 1000 / 30);
const counter = new DataView(new ArrayBuffer(8));
counter.setBigUint64(0, BigInt(timeStep));
const key = await crypto.subtle.importKey(
  'raw', secret, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']
);
const sig = new DataView(await crypto.subtle.sign('HMAC', key, counter));
const offset = sig.getUint8(19) & 0x0f;
const code = (sig.getUint32(offset) & 0x7fffffff) % 1000000;
console.log(code.toString().padStart(6, '0'));

# Python — HOTP generation (RFC 4226)
import hmac, hashlib, struct
def hotp(secret: bytes, counter: int, digits: int = 6) -> str:
    msg = struct.pack('>Q', counter)
    h = hmac.new(secret, msg, hashlib.sha1).digest()
    offset = h[-1] & 0x0f
    code = struct.unpack('>I', h[offset:offset+4])[0] & 0x7fffffff
    return str(code % 10**digits).zfill(digits)
print(hotp(b'\x1f\x86\x98...', 42))

Security Notes

• Secret storage — The Base32 secret is the single point of failure. Anyone with the secret can generate valid codes. Never share it over unencrypted channels.
• Clock drift — TOTP tolerates +/-1 time step by default. If codes consistently fail, check your device clock against an NTP source.
• SHA-1 is fine for OTP — Unlike digital signatures, HMAC-SHA-1 for OTP is not vulnerable to collision attacks. SHA-256/512 are optional margins, not requirements.
• Rate limiting — OTPs are short-lived but brute-forceable (6 digits = 1M combinations). Servers should lock after 3-5 failed attempts.

Related Tools

Need a human-friendly secret instead of random bytes? Try the Passphrase Generator. For raw entropy testing or generating the shared secret itself, use the Random Byte Generator. To sign or verify JWT tokens that may use OTP-based 2FA, see the JWT Signer & Verifier.