How to Generate a TOTP or HOTP Code

To generate an OTP, select TOTP or HOTP, enter a Base32 secret, choose six or eight digits, and provide the time-period or counter settings required by that mode. TOTP is the default and uses the current time; HOTP uses the counter you enter.

What the OTP Generator does

The OTP Generator produces standard one-time passwords for two-factor authentication and access testing. It supports two standard generation modes based on HMAC-SHA1: time-based one-time passwords (TOTP) and HMAC-based one-time passwords (HOTP).

In TOTP mode, the generator reads the current Unix epoch time, divides it by the configured interval, and calculates the authentication token along with the remaining validity seconds. In HOTP mode, it computes the token strictly from an incrementing integer counter independent of the system clock. The generator normalizes Base32 secret keys automatically, ignoring letter casing and stripping surrounding whitespace.

Step-by-step instructions

1. Select your mode: choose TOTP for time-synchronized authentication or HOTP for event-driven counter tokens.
2. Enter your shared Base32 secret string into the secret field.
3. Choose your target passcode length: select 6 digits or 8 digits (default is 6).
4. If using TOTP mode, adjust the time period interval in seconds if your system requires a non-standard window (default is 30 seconds, accepts whole numbers from 1 to 86,400).
5. If using HOTP mode, enter your current integer counter value (default is 0, accepts whole numbers up to 18,446,744,073,709,551,615).
6. Run the tool to generate the numerical passcode and review the output.

Under the hood, both modes rely on the keyed-hash message authentication code algorithm. For underlying hashing workflows and verification, you can also explore the HMAC Generator.

How to read the result

A successful computation displays the formatted numerical code, preserving any leading zeros according to your selected digit length.

For TOTP generation, the result includes an active countdown displaying how many seconds remain before the current time window expires and a new passcode takes effect. For HOTP generation, the result reflects only the specific counter provided, and the remaining time field displays zero because counter-based tokens do not expire by clock time.

The tool outputs only the generated passcode, mode, counter step, and expiration details. Your secret key is not echoed in plain text outputs.

Worked example

Suppose you are testing a two-factor authentication setup that provides the Base32 secret JBSWY3DPEHPK3PXP and expects a standard 6-digit TOTP code with a 30-second refresh period.

1. Select TOTP mode.
2. Paste JBSWY3DPEHPK3PXP into the Base32 secret field.
3. Set the code length to 6 digits and keep the period at 30 seconds.
4. Execute the generator.

The tool calculates the current Unix time step, performs the HMAC-SHA1 computation, and returns a 6-digit numerical token along with the exact remaining seconds in the active 30-second window.

Limitations

• The generator computes tokens exclusively using HMAC-SHA1; other cryptographic hashing algorithms (such as HMAC-SHA256 or HMAC-SHA512) are not supported.
• The tool requires a valid Base32 secret key; raw hex strings or plain ASCII text must be Base32-encoded first.
• Custom time offsets or simulated client-server clock drift cannot be configured manually.

Common mistakes

• Entering non-integer counter values: Entering decimal numbers or special characters in the counter or period fields causes the calculation to fail.
• Using invalid Base32 characters: Non-Base32 characters (outside A-Z and 2-7) in the secret field prevent proper decoding and token generation.
• Mixing up TOTP and HOTP expectations: Expecting a time-based authenticator app to accept a counter-based HOTP code will result in authentication failure.

Frequently asked questions

Does TOTP use the current time?

Yes. TOTP calculates the current token by taking the system Unix epoch timestamp and dividing it by the selected interval period (defaulting to 30 seconds).

Does HOTP depend on the clock?

No. HOTP relies solely on the incrementing counter integer you enter and does not inspect or depend on the system clock.

Does the generated result show the secret?

No. The output displays only the generated numerical code, active counter or time step, and remaining validity seconds. The secret is omitted from the result.