2FA.GLOBAL / GUIDE
How to use TOTP: setup secrets, codes and time synchronization
Learn to generate TOTP codes from a setup secret, match authenticator parameters and troubleshoot common two-factor authentication problems.
1. Find your own setup secret
When enabling authenticator-based two-factor authentication, your service usually displays a QR code and a manual setup key. That key is the shared secret. A six-digit code is not a setup secret. If the service no longer shows the key, follow its account recovery or authenticator replacement process.
2. Match the parameters
Paste the Base32 secret, or an otpauth://totp URI. For plain secrets, the defaults are SHA-1, six digits and 30 seconds. An otpauth link can specify SHA-256, SHA-512, eight digits and integer periods from 1 to 300 seconds; the parameters are detected automatically. For a URI, its parameters take precedence; missing parameters use standard defaults. HOTP counter-based URIs are not supported.
3. Check the clock and expiry
The code depends on your device clock. Enable automatic date and time in system settings. The countdown shows how long the current code remains in its time period; a service may apply its own acceptance window. Wait for a fresh code if only a few seconds remain.
4. Keep the secret private
Anyone holding a setup secret can generate the same codes. Do not include it in URLs, screenshots, shared documents or support messages. This tool keeps it in the current page and does not offer a secret vault. Use a dedicated authenticator for daily use and store recovery codes securely.
TOTP, HOTP and other OTP methods
OTP is a broad term for one-time passwords. TOTP changes with time; HOTP changes with an event counter. SMS codes, email codes and push approvals are different methods. This website generates TOTP codes only.
Compatibility and independence
Standard TOTP entries used with Google Authenticator, Microsoft Authenticator and Authy can produce matching codes with identical parameters. Services such as Binance, GitHub, Discord and X may offer authenticator-based 2FA depending on their account settings. This site is independent and is not affiliated with these brands.
Technical reference：RFC 6238 · Key URI Format
Back to generator ↗