TOTP/HOTP Generator: complete usage guide
Generate TOTP and HOTP one-time passwords for MFA setup, integration testing, and recovery playbooks with clear timing and counter guidance to avoid authentication troubleshooting blind spots.
What this tool does
It computes one-time passcodes from shared secrets using time-based or counter-based OTP algorithms.
It helps verify MFA enrollment flows and authenticator interoperability before production rollout.
It provides deterministic troubleshooting support for clock skew, step window, and secret formatting issues.
Typical use cases
- Test MFA setup flows during auth feature development.
- Validate OTP compatibility across mobile authenticators and backend verifiers.
- Reproduce support incidents involving expired or invalid OTP codes.
- Prepare break-glass recovery runbooks with known-good OTP generation steps.
- Confirm HOTP counter handling in hardware token style integrations.
Input examples
TOTP secret
JBSWY3DPEHPK3PXP
Time step config
period: 30s, digits: 6, algo: SHA1
HOTP config
counter: 42, digits: 6, algo: SHA256
Output examples
Current TOTP
482193 (valid for remaining 18s)
HOTP sample
913520 (counter 42)
Troubleshooting note
If verification fails, compare server clock and secret normalization first.
Common errors and fixes
Codes fail due to time drift
Synchronize client and server clocks and allow small verification window.
Secret format mismatch
Ensure Base32 secret is clean and padding expectations are handled correctly.
Wrong algorithm or digit length
Match verifier settings exactly for period, digits, and hash algorithm.
HOTP counter desynchronization
Resync counter state between token and verifier during troubleshooting.
Security and privacy notes
For the shared privacy terminology, local processing model, external-request labels, and DevTools verification workflow, see the Trust Center.
- OTP generation is local, but shared secrets are highly sensitive and must be handled carefully.
- Never paste production MFA secrets into tickets, chat logs, or public recordings.
- Rotate test secrets after debugging sessions and remove them from temporary notes.
Step-by-step workflow
- Set the minimum options required by TOTP/HOTP Generator and generate one sample output first.
- Review the first result for structure, readability, and policy fit before generating variants.
- Adjust one setting at a time so you can see which control changes the output.
- Save one approved sample or preset to anchor future runs and reviews.
Quality checklist before sharing output
- Confirm TOTP/HOTP Generator output matches the constraints or style rules you intended to apply.
- Check that generated values are plausible for the real workflow, not just the demo case.
- Verify repeated runs behave as expected when randomness or presets are involved.
- Remove any real account names, IDs, or internal references before sharing generated output.
Operational notes
TOTP/HOTP Generator is most useful when you lock in a reviewed preset, then generate repeatable samples for product, QA, or content workflows.
Frequently asked questions
Why does my TOTP code expire so quickly?
TOTP is time-window based, commonly with 30-second periods.
How is HOTP different from TOTP?
HOTP increments by counter, while TOTP derives codes from current time.
Can I test MFA reliably in staging?
Yes, as long as secret format and clock sync match production verifier behavior.
What is the most common OTP failure cause?
Clock skew and secret formatting mismatches are frequent root causes.
