Generate a Base32 TOTP secret

For developers and administrators setting up a new account flow protected by a second authentication factor.

Prepare a Base32 TOTP secret for two-factor authentication and receive a value ready to configure in a compatible account setup.

How to use

Enter a number of bytes between 10 and 32 in the field used to generate the secret.
Run the generation to obtain a Base32 value that can be used as a TOTP secret.
Copy the secret and configure it in your two-factor authentication app or compatible service.
Test the setup immediately with a generated code, then clear the secret from the screen if you should not keep it there.

Example

An administrator is preparing a new account protected by a second factor. They enter 20 as the number of bytes, run the generation and check that the Base32 value can be stored in the authentication tool they plan to use.

Input

Output

56OKLLC63DRCDY2WUH6IL52ZM3TCLHZB

Limits and formats

The generated secret must be stored somewhere safe; if it is lost, the second-factor setup will need to be restarted.
The tool creates a Base32 secret, but it does not configure your application or your account for you.
The chosen size affects the generated secret, so respect any length requirement from the service that will use it.
Do not share the secret or publish it in a document or ticket that unauthorised people can read.

Where processing happens

Generation runs entirely in your browser. The number of bytes you enter and the resulting secret stay on your device and are not sent anywhere. You do not need an account to use the tool.

Frequently asked questions

Which byte size should I choose for a TOTP secret?

The field accepts a value from 10 to 32 bytes. Choose a length that is compatible with your application or service; when in doubt, follow the recommendation of the platform that will store the secret.

Can I reuse the same secret for several accounts?

It is better to avoid sharing one secret across multiple accounts. A separate secret for each access limits the impact if one of them is compromised.

Is the generated secret sent anywhere?

No. The operation takes place in your browser and the secret remains on your device. You must copy it yourself into the application or service that will use it.