Create a two factor secret, see the live 6 or 8 digit code and copy the otpauth URI for any authenticator app.
Most authenticator apps only support SHA-1, 6 digits and 30 seconds. Change these only if your server and your app both agree.
The Base32 secret is what your server stores for that user. It is created here with the browser's cryptographic random source, so it is not guessable.
Copy the otpauth URI and turn it into a QR code, or have the user type the secret manually. The issuer and account names are what shows up in their app.
The code above updates every period. If your server produces the same digits for the same secret at the same moment, your implementation is correct.
Time based One Time Password, defined in RFC 6238. The server and the app share a secret, both take the current time divided into 30 second slots, and both run HMAC over it. Because they compute the same thing from the same inputs, no code ever has to travel over the network.
Any of them. Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and the rest all read the same otpauth URI format.
Because several popular apps quietly ignore those parameters and compute a SHA-1 six digit code anyway. The result is codes that never match and a support ticket you cannot reproduce. Stay on the defaults unless you control both ends.
Codes stop matching. Servers usually accept the previous and next window as well as the current one, which tolerates about a minute of drift. Widening that window further weakens the protection.
The secret is generated in your browser and never sent anywhere, so the tool itself is not the risk. The judgement call is your own machine and your own screen. For a production enrolment, generate the secret on the server that will store it.
Copy the otpauth URI and paste it into our QR code generator. Authenticator apps scan the URI, not an image of the secret, so any correctly encoded QR code works.
Because people sometimes have to type the secret by hand. Base32 leaves out the characters that get confused with each other, so there is no 0 against O or 1 against l.
Yes, and by a wide margin. SMS can be intercepted or moved to another phone through a SIM swap, while a TOTP secret never leaves the device it was enrolled on. Neither one stops a convincing phishing page, which is what hardware keys are for.
Free QR code generator with custom colors. Create QR codes for URLs, text or any data, adjust size and color, and download as PNG.
Open ToolSign a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512. Hex and Base64 output.
Open ToolOnline password generator, no sign-up. Create strong, random passwords with customizable length and character sets. Generated locally and never stored.
Open Tool