TOTP Generator Online

Add two-factor authentication: create TOTP secrets with an otpauth:// QR code for Google Authenticator, compute and verify 6–8 digit codes (RFC 6238 / HOTP).

Result

Press “Run” to see the result.

The TOTP API gives your application two-factor authentication without a library. action=generate creates a random Base32 secret and its otpauth:// URI, with your issuer and the user’s account; action=qr returns the same as a PNG or SVG QR code to scan with Google Authenticator, Microsoft Authenticator, Authy or 1Password. action=verify with secret and code checks a code typed by the user, accepting one time step of clock drift by default (window).

action=code returns the current and next codes and how many seconds the current one remains valid. SHA-1 (the default every app supports), SHA-256 and SHA-512, 6 or 8 digits and other periods are supported, as well as counter-based HOTP (RFC 4226) with type=hotp; codes match the RFC test vectors.

Nothing is stored: the secret travels with each request and responses are not cached. Keep secrets encrypted in your own database, prevent replay by remembering the last accepted time_step per user, and rate-limit verification attempts.

Use this in your code

curl "https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Is it compatible with Google Authenticator?

Yes, with the defaults (SHA-1, 6 digits, 30 seconds). Some apps ignore other algorithms or periods.

Do you keep the secret?

No. It is only used to compute the answer and the responses carry Cache-Control: no-store. Store it yourself, encrypted.

How do I stop a code from being reused?

verify returns time_step; save the last accepted one per user and reject codes with the same or an older step.