TOTP Secret Generator
Generate a 160-bit base32 secret and the matching otpauth:// URI for any authenticator app.
—
—
Worked example
A 160-bit key becomes 32 base32 characters. That is the same key length Google Authenticator uses when it provisions a new account, and it is the length most servers assume.
A TOTP secret is just random bytes, encoded in base32 so it can be typed and scanned as text. Nothing about the format is secret — the secrecy is entirely in the randomness. This page uses crypto.getRandomValues, the browser CSPRNG, not Math.random, which is predictable enough to reconstruct from a handful of outputs.
Picking a key size
RFC 4226 requires at least 128 bits and recommends 160. Six-digit codes only carry about 20 bits of entropy per attempt, so a longer key does not make individual guesses harder; it protects against offline attacks on a captured key. 160 bits is the interoperable default and what every authenticator app expects.
Using the URI
The otpauth:// form is what a QR code encodes. Paste it into any QR generator that accepts text — the QR generator on this site does — and scan the result with your authenticator app. Keep the secret out of shared documents; the URI contains the key in plain text.
If you are building the server side
Store the base32 secret encrypted at rest, and treat it as a long-term credential rather than a temporary token. Rate-limit verification attempts to a handful per minute per account, and reject codes from a window that has already been used for that account — replay within the same 30 seconds is otherwise possible.