Generate a TOTP secret, see the QR code, and verify tokens.
Generates a time-based one-time password (TOTP) secret following RFC 6238 — the same standard used by Google Authenticator, GitHub, AWS and most two-factor authentication systems. The secret, QR code and verification all run locally in your browser.
The QR code encodes an otpauth:// URI that authenticator apps recognise automatically. You can also copy the Base32 secret for manual entry. Codes rotate every 30 seconds using HMAC-SHA1.
This tool is for setting up and testing TOTP secrets during development. Never share a production secret over an insecure channel — anyone with the secret can generate valid codes.
No. Everything runs locally in JavaScript on your device — nothing is transmitted or stored.
Yes. The output is generated locally in your browser and is yours to use however you like — commercially or otherwise.
Yes. Everything is generated locally in your browser. You can copy, download and use the output however you like.
Vai.la turns any URL into a short link with click statistics, QR Code and your own biolink.
Vai.la is not responsible for how the tools are used or for decisions made based on their results.