One-Time Password Generator

Generate a Code From Your Setup Secret

Paste the Base32 setup secret from an account you’re authorised to access. The generator uses that secret and your device’s current time to calculate a time-based one-time password (TOTP). The account checks the code against its own calculation for the same time window.

A setup URI beginning with otpauth://totp/ supplies its own settings. If you paste a Base32 secret by itself, the defaults are SHA-1 and six digits, with a new code every 30 seconds. Open Authenticator settings to choose SHA-256 or SHA-512, switch to eight digits or enter a period from 1 to 300 seconds.

Base32 uses the letters A to Z and the digits 2 to 7. The field accepts either letter case and ignores spaces in a copied secret. The generator reports invalid Base32 and rejects counter-based setup URIs. RFC 6238 describes how the time window and setup secret determine the code.

Use the Code Before It Expires

Copy the current code and enter it on the account’s sign-in screen before the countdown ends. The generator calculates a fresh code at the start of the next time window. If the countdown is nearly finished, wait for the next code before copying it.

If the account rejects the code, turn on automatic date and time in your device settings. Check the hash algorithm, code length and period against the account’s authenticator setup. Enter every digit, including a zero at the start.

To try the countdown without entering an account secret, choose Load example. It uses the public test secret from RFC 4226 and the default 30-second period, so the displayed code depends on when you try it.

Keep the Secret on Your Device

A setup secret can generate future codes for as long as the account accepts it. Keep the secret and any setup URI out of page addresses, analytics and logs. Leave them out of shared screenshots and screen recordings.

This generator calculates the code in your browser. The tool sends neither the setup secret nor the code to a server or analytics service and saves neither to browser storage. Clear secret removes the entry and the current code from the tool. Copy code puts only the current code on your device’s clipboard, where clipboard history can keep it.

For regular sign-ins, use a trusted authenticator app under the Australian Signals Directorate’s guidance for securing business accounts. If you think someone else saw the setup secret, replace it through the account’s security settings.