TOTP / HOTP Authenticator

Generate time-based (RFC 6238) or counter-based (RFC 4226) one-time passwords from a Base32 shared secret, using HMAC-SHA1 and dynamic truncation. Optional otpauth QR for provisioning. Everything runs locally — your secret never leaves the browser.

Secret (Base32, no spaces)

Digits

Step (s, TOTP)

------

Enter a Base32 secret.

Show otpauth QR

HMAC-SHA1 + RFC 4226 dynamic truncation. Secret stays in your browser. Runs locally.