Password & Security
Generate random one-time passwords for authentication.
OTP
886653
1 code generated
These are random one-time passwords, not time-based (TOTP). Each code is generated independently with cryptographically secure randomness. Digits must be 4–8; count determines how many codes to generate.
An OTP generator is a security tool that produces single-use passwords, typically 6-digit codes valid for 30-60 seconds (TOTP) or valid for one login attempt (HOTP). Each code is mathematically derived from a secret key and time or counter value, making it impossible to predict the next code even if a previous one is exposed.
The generator uses industry-standard algorithms (RFC 4226 for HOTP, RFC 6238 for TOTP) combined with a shared secret key to compute unique codes. For time-based OTPs, the system divides current time into 30-second windows and hashes the result with your secret. For counter-based OTPs, each successful use increments a counter and generates a new code. The last 6-8 digits of the hash become your one-time password.
TOTP = HMAC-SHA1(secret_key, time_counter) mod 10^6; HOTP = HMAC-SHA1(secret_key, counter) mod 10^6HMAC-SHA1 cryptographically combines your secret key with time (for TOTP) or a counter (for HOTP). The modulo operation (mod 10^6) extracts the final 6 digits. Different implementations may use SHA-256 or SHA-512 for stronger security.
| Input | Result | Notes |
|---|---|---|
| Secret key: JBSWY3DPEBLW64TMMQ5A, Time-based (TOTP) | 847392 (valid for 27 seconds, then expires) | Same secret generates different codes every 30 seconds |
| Secret key: JBSWY3DPEBLW64TMMQ5A, Counter = 0 | 278532 (changes only on next counter increment) | Counter-based OTPs used by some banks; counter increments per use |
| Gmail 2FA authentication request at 3:45pm | 562801 (expires at 4:14pm) | Most services use TOTP with 30-second windows for user convenience |
Yes—this is a client-side generator that doesn't transmit your secret key to any server. However, for maximum security with production accounts, store secret keys in a dedicated authenticator app on your phone rather than trusting any online tool with production secrets.
TOTP (time-based) generates new codes every 30 seconds based on current time—used by most consumer apps. HOTP (counter-based) generates one code per login attempt—used by some banks and enterprise systems. TOTP is more user-friendly; HOTP is harder to brute-force.
Most likely causes: (1) your device clock is out of sync—check the time is correct; (2) you waited longer than 30 seconds to enter the code—OTPs expire quickly; (3) the secret key was entered incorrectly; (4) the service expects a different code length (some use 8 digits instead of 6).
Technically yes, but it's a major security risk—both would generate identical codes, defeating two-factor protection. Each account should have a unique secret key generated by that service.
Most services provide recovery codes during setup—use these to regain access and generate a new secret. Store recovery codes in a secure location (printed, password manager, safe). Without recovery codes or backup authentication methods, you may be permanently locked out.
TOTP codes can't be replayed—each expires within seconds. However, if someone intercepts you entering the code (shoulder surfing, phishing, malware), they could use it immediately. Always verify you're on the official website before entering OTPs.