Free otpauth Link Generator

An otpauth link, formally a key URI, is the address format authenticator apps read when you scan a 2FA setup QR code. The structure is otpauth://TYPE/LABEL?PARAMETERS, where TYPE is totp for time-based codes or hotp for counter-based codes, the label names the issuer and account, and the parameters carry the shared secret plus optional settings. The format comes from the Google Authenticator Key Uri Format document and is what most authenticator apps parse when they enroll a new account.

The shared secret, encoded in Base32. The Key Uri Format spec points at the Base32 definition in RFC 3548 (carried forward in RFC 4648), which uses the letters A to Z and the digits 2 to 7, and it says the = padding is not required and should be omitted. Our tool strips spaces, dashes, and trailing padding automatically, then validates what remains against that alphabet. If your secret contains a 0, 1, 8, or 9, it is not Base32, it may be hex or a raw string that needs encoding first.

TOTP for almost everything. TOTP, defined in RFC 6238, derives the code from the current time, so codes rotate on their own every period, 30 seconds by default, and the server and app only need roughly synchronized clocks. HOTP, defined in RFC 4226, derives the code from a counter that both sides increment, which suits hardware tokens without clocks but means the counter can drift if codes are generated and never used. Every mainstream login flow you have seen with a rotating 6-digit code is TOTP.

The counter is required for hotp URIs and has no meaning for totp ones. It sets the initial counter value, the starting point both the app and your server count from. Each generated code advances the app's counter, and each successful verification advances the server's. Most deployments start at 0. If you build an hotp URI without a counter, apps that follow the spec will reject it, which is why our tool refuses to generate one without it.

Leave it on SHA1 unless the app you are enrolling into documents otherwise. SHA1 is the default in the Key Uri Format, and RFC 6238 specifies HMAC-SHA-1 as the baseline with HMAC-SHA-256 and HMAC-SHA-512 as options implementations may use. The catch is client support: the Key Uri Format doc itself notes that Google Authenticator currently ignores the algorithm parameter, so a URI that declares SHA256 will still be computed with SHA1 there and the codes will not match your server. The safe path is SHA1 end to end.

Once as a prefix inside the label, otpauth://totp/Issuer:account, and once as an issuer query parameter. The Key Uri Format doc strongly recommends sending both because older Google Authenticator versions ignore the issuer parameter and read only the label prefix, while the parameter is the forward-looking home for the value. Our tool writes both from the one issuer field, and it also enforces the spec rule that neither the issuer nor the account name may itself contain a colon.

You can put digits=8 and any period in the URI, both are legal parameters, but check what your target app honors before you rely on them. The Key Uri Format doc says the digits value may be 6 or 8 and that the Android and BlackBerry Google Authenticator builds ignore it, and that the period parameter is ignored too. RFC 6238 recommends 30 seconds as the default time step. Non-default values are only worth it when both your server library and your users' apps support them.

The tool is built so that nothing you type is transmitted: the URI and the QR code are constructed with client-side JavaScript in your browser, there is no server call, and the history list stores issuer and account names only, never secrets. That said, the screen itself is the risk surface. Anyone who photographs the QR, shoulder-surfs the URI, or finds it in a pasted screenshot can generate your codes forever after. Generate setup codes in private, deliver them over a secure channel, and rotate the secret if you suspect exposure.

RFC 4226 requirement R6 says the shared secret must be at least 128 bits and recommends 160 bits, and RFC 6238 adds that keys should match the length of the HMAC output, which is 160 bits for SHA1. In Base32 terms, 160 bits is 32 characters. The random secret button on this page generates exactly that: 20 bytes from crypto.getRandomValues, encoded to 32 Base32 characters. The tool warns you when a secret you paste falls under the 128-bit floor.

Any app that implements the Key Uri Format, which is the de facto enrollment standard the format document describes. The QR encodes nothing but the otpauth URI itself, exactly as documented, so compatibility is decided by the app, not by anything specific to this generator. For maximum compatibility keep the defaults, SHA1, 6 digits, 30 seconds, since those are the values the format designates as defaults and the ones every implementation handles.

No. Those services generate their own secret when you turn on 2FA in their security settings, and you must scan the QR they show you, because the same secret has to end up on their server and in your app. This tool is for the other side of the handshake: developers and IT admins who are building a login system, testing a TOTP library, provisioning shared service accounts, or re-creating a setup QR from a secret they already hold.

Free, no sign-up, no limits on how many URIs or QR codes you generate. It is one of the free tools we publish alongside the Flyn link shortener. Because the whole tool runs in your browser, there is nothing metered to charge for: no API calls, no stored data, no watermarks on the downloaded PNG or SVG.

The usual suspects, in order: the server and phone clocks disagree by more than the accepted window, TOTP tolerates only small drift; the secret was corrupted in transit, often by a 0 or 1 sneaking into a retyped Base32 string that only contains letters and 2 to 7; the URI declared SHA256 or 8 digits but the app silently used SHA1 with 6, which happens because some apps ignore those parameters; or, for HOTP, the counters have drifted apart. Rebuild the URI with defaults and a freshly generated secret to isolate which one it is.