Generate TOTP secrets and authenticator QR codes to test your 2FA implementation. Scan with Google Authenticator or Authy and watch the live 6-digit code update every 30 seconds. RFC 6238. Nothing leaves your browser.
Free, no sign-up — one of the SaaSQuickStart Privacy & Security tools.
Encrypt with AES-256 before storing. The secret is a long-term credential — if it leaks from your database, attackers can generate valid codes indefinitely. Never store it in plain text.
Standard TOTP (RFC 6238) uses HMAC-SHA1. Some authenticator apps support SHA-256 and SHA-512 but not all. Stick with SHA1 for maximum compatibility with Google Authenticator, Authy, and 1Password.
The 30-second window is the RFC standard. The progress bar above shows how much time remains. Your server should accept the previous window too (±30s) to handle clock drift and slow users.