YourQRTools
Back to the tools
Practical guide

Use a TOTP generator and understand the secret key

Generate a code for an account you own or administer, match the service settings, and distinguish setup secrets from temporary login codes.

Start with a valid setup secret

TOTP depends on a shared secret and timing settings. Use the setup key supplied by the service for an account you own or are authorized to administer. It is commonly represented in Base32 and may appear in an otpauth setup address. The short changing login code is not that secret.

If you lose the key and authenticator, this tool cannot derive the secret from a username or old code. Use the provider's recovery options.

Match rather than guess

Choose the digit count, period and algorithm used by the service verifying the code. Six digits and a thirty-second period are common, but not universal. Changing an option to make a result look familiar does not make it compatible with the account.

Setup data may include these options. Review imported or entered values; an account label or issuer name is not a substitute for the correct secret.

Keep time accurate

The result depends on your device's time. Enable automatic system time if the clock is inaccurate. Near the end of a countdown, wait for the next code before copying and switching pages.

If a code is rejected, check the clock, secret, settings and intended service. Displaying a code does not confirm the provider will accept it.

Treat secrets as credentials

Calculations run in your browser, and this tool does not add the secret to a saved account list. Enter it in the intended field rather than the page address, and avoid shared screenshots. Clear the field afterward and keep any needed backup somewhere you trust. This is a temporary calculator, not an account-recovery plan.

Sources & further reading

Back to the tools