Does the secret leave my browser?

No. Web Crypto computes the code locally. The provisioning URI contains your secret, so protect any copied or downloaded result.

Why does Generate HOTP return the same code again?

The secret, counter, and digit count determine the code. Generation does not increment Counter or contact your verifier.

Can I use the working sample for two-factor authentication?

No. RFC 4226 publishes that test secret. Anyone can reproduce its codes. Use your own securely provisioned secret.

HOTP Generator | Tool Factory

Tool workspace

Your Base32 secret and HOTP code stay in this browser. The provisioning URI contains the secret.

Needs input

Run the tool when your input is ready.

Base32 secret

Enter a Base32 secret containing 16–128 decoded bytes. Your secret stays in this browser.

Options

Account label

Code length

Counter

Enter a decimal integer from 0 through 18446744073709551615. Generation does not increment this field.

Your result appears here

Generate RFC 4226 HOTP codes locally with a Base32 secret, exact 64-bit counter, and 6–8 digits. Run Appendix D's sample.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

HOTP Generator computes an HMAC-SHA1 code from a Base32 secret and an unsigned 64-bit counter. Choose 6, 7, or 8 digits. The browser uses Web Crypto for HMAC and preserves the counter as an exact integer. Your secret stays in the browser. The result includes a provisioning URI containing that same secret.

Password shows the zero-padded decimal code. URI carries the Base32 secret, account label, algorithm, digit count, and counter.

Check an HOTP implementation against the published Appendix D vector.
Compare a known counter with a verifier during controlled integration testing.
Inspect provisioning values without sending the shared secret to a server.

Treat the provisioning URI as a secret. Copy or download it only when you intend to retain the shared secret.

Sources: RFC 4226: HOTP algorithm and Appendix D test values; RFC 4648 section 6: Base32 encoding

Instructions

Enter your Base32 secret using A–Z and 2–7. The parser accepts lowercase letters, spaces, and correctly placed trailing padding.
Enter an account label for the provisioning URI. The label does not change the generated password.
Set Code length to match your verifier. Enter the exact decimal Counter value expected for this event.
Select Generate HOTP. Generation leaves Counter unchanged, so repeat calls with identical settings return the same code.
Select Run working sample to reproduce Appendix D at counter 0. Never use the published test secret for an account.

Example

Input: GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ

Settings: Account label: RFC 4226 sample; Code length: 6; Counter: 0.

Result: URI: otpauth://hotp/RFC%204226%20sample?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ&algorithm=SHA1&digits=6&counter=0 Password: 755224

RFC 4226 Appendix D specifies the public ASCII secret 12345678901234567890. Its Base32 representation produces password 755224 at counter 0.

Limits

The secret must contain 16 through 128 decoded bytes. RFC 4226 requires at least 128 secret bits.
Counter accepts 0 through 18446744073709551615. Enter decimal digits without signs, fractions, or exponent notation.
This tool generates HOTP, which counts events. It does not generate time-based TOTP codes or synchronize a remote verifier.
The provisioning URI contains the secret. Anyone who receives it can generate codes for that secret.
The tool requires a secure browser context with Web Crypto. Blank secrets and malformed Base32 values cause errors.