TOTP secret key generator

RFC 4226 requires a shared secret of at least 128 bits and recommends 160 bits. 160 bits is also the output size of SHA-1, the default HMAC for TOTP. If you use HMAC-SHA-256 or SHA-512, a longer key of 32 or 64 bytes matches those hash sizes, but 160 bits of real randomness is already far beyond guessing.

Base32 uses only the letters A to Z and digits 2 to 7, so a secret can be read aloud or typed without confusing 0 with O or 1 with l. Every 5 bytes become 8 characters, so 20 bytes become exactly 32 characters with no padding. Apps usually ignore spaces and lower case when you type one in.

• Use a cryptographically secure random source, such as crypto.randomBytes in Node.js or secrets.token_bytes in Python. Never use Math.random or a timestamp.
• Make a new secret for every user and every enrolment. Never reuse one.
• Store the secret encrypted at rest. Unlike a password it cannot be hashed, because the server needs it to compute codes.
• Confirm enrolment by asking for a valid code before you switch 2FA on.

This page is a handy way to make secrets for development, demos and test accounts. For production, generate secrets inside your own backend so they never pass through a person's screen more often than needed.

Guides