TOTP secret generator
Generated in your browser · never sent, never stored
Time-based one-time passwords work from a secret both the server and the authenticator app hold. This generates that secret: 160 random bits, base32-encoded without padding, which is the form every authenticator app expects.
How to generate a TOTP secret
The defaults in the URI. SHA-1, six digits, a thirty-second period: look dated, and they are, but they are what RFC 6238 specifies and what every mainstream authenticator implements. Deviating breaks compatibility for no security gain, because the secret’s 160 bits are what carries the strength here, not the hash. The one thing worth knowing about handling: the secret is a symmetric key. If your database leaks it, an attacker generates codes as easily as the user does, so it needs the same protection as a password hash and rather more than a session token.
Questions
RFC 4226 requires at least 128 bits and recommends 160. This generates 160, which is 32 base32 characters.
Because that is what RFC 6238 specifies and what authenticator apps implement. The known weaknesses in SHA-1 are collision attacks, which do not apply to HMAC in this construction.
The standard allows it, but most authenticator apps ignore non-default values, so codes will not match. Stay with six digits and thirty seconds.
Render it as a QR code for the user to scan. The QR generator on this site will do that without sending it anywhere.
No. It is generated in this page. If you paste it into a system that logs it, treat it as compromised and generate a new one.