2FA Secret Key Generator

Create a new 160-bit Base32 TOTP secret, labeled otpauth URI, and scannable QR code entirely in this browser.

Web Crypto
160-bit default
No secret storage
QR + otpauth URI

Create new enrollment material

Browser only

Creates new enrollment material; it cannot recover an old account secret. Already have a secret? Generate a 2FA QR code.

Key features

One secret key generator, complete enrollment output

The 2FA secret key generator starts with cryptographically secure random bytes and keeps every derived form together. Generate once, enroll deliberately, and move the long-lived secret into the protected system that will verify TOTP codes.

Secure random source

Web Crypto fills 20 bytes instead of using predictable timestamps or Math.random.

Standard Base32

The 160-bit secret key becomes a compatible 32-character RFC 4648 value.

Complete otpauth URI

Issuer, account, algorithm, digits, and period travel together without manual assembly.

QR and PNG output

Scan the enrollment QR or download a controlled copy for your setup workflow.

TOTP secret key generator turning local randomness into an authenticator enrollment QR code

What it is

What is a 2FA secret key generator?

A 2FA secret key generator creates the shared random input used by time-based one-time password authentication. The authenticator stores one copy, the verifying application stores another, and both independently calculate the same TOTP code for the current time window. The secret key itself is not a short login code; it is the long-lived credential behind every future code.

This page differs from the 2FA code generator, which calculates a current code from an existing secret, and the QR generator, which repackages an existing secret. The TOTP secret key generator creates new enrollment material from secure randomness. It never queries an account provider and cannot retrieve or restore a previously issued secret key.

After enrollment, use the TOTP verifier to confirm a test code against the new secret, then follow the troubleshooting guide if your application rejects the result.

Entropy: 160 random bits (20 bytes)
Secret: 32 Base32 characters
URI: otpauth://totp enrollment data
QR: Canvas preview + PNG download
Defaults: SHA-1 · 6 digits · 30 seconds

How to

How to generate a TOTP secret key

A strong secret key is only the first step. The issuer and authenticator must enroll the same value, the server must protect its copy, and a fresh TOTP code must be tested before the setup is considered complete.

Enter account and issuer labels before generating a TOTP secret key

Add a clear account label

Enter the account and optional issuer that should appear in the authenticator app.

Generate a 160-bit Base32 TOTP secret with browser Web Crypto

Generate a 160-bit secret

Create a new random Base32 secret and standard otpauth URI with Web Crypto in this tab.

Scan the generated TOTP QR code and confirm enrollment on a trusted device

Enroll and confirm

Scan the QR on a trusted device, store the server-side secret safely, and verify a fresh TOTP code.

Why choose it

A safer temporary generation workflow

A 2FA secret key generator should make security properties visible instead of hiding them behind a generic random-string button. Every output here can be inspected and moved into your own enrollment system.

Strong by default

The default secret key starts with 160 bits from the browser’s cryptographic random number generator.

No account or vault

The 2FA secret key generator does not ask you to save credentials in a new online account.

Parameters stay explicit

Advanced settings are recorded in the otpauth URI so the authenticator receives the same configuration.

Enrollment-ready output

Base32, URI, QR, clipboard, and PNG options cover manual and camera-based setup without another tool.

Pro tips

Protect the TOTP secret key after generation

The generated secret key is a credential, not harmless setup text. The TOTP secret key length and random source matter, but storage, uniqueness, rotation, and verification matter just as much.

Generate one secret per account

Independent secret keys limit the damage of one disclosure and allow individual revocation without breaking every enrollment.

Encrypt the server-side copy

Store production TOTP secrets with restricted access and encryption appropriate to your application’s threat model.

Keep compatible defaults

Use SHA-1, six digits, and 30 seconds unless your selected authenticator and verifier both document other settings.

Verify before clearing

Scan the QR, produce a fresh TOTP code, and confirm it with your application before removing the only enrollment copy.

Separate test and production

Never reuse a secret key from a development fixture for a real user or production service.

Limit: this 2FA secret key generator does not register the secret with Google, Microsoft, GitHub, or another provider. You must control the verifier or be inside that provider’s official setup flow.

Use cases

Recommended TOTP secret generator settings

These recipes keep the 2FA secret key generator aligned with the real enrollment job. When a library or provider specifies different parameters, its documented configuration takes priority over the defaults below.

Standard web application

Use 160-bit secret keys, SHA-1, six digits, and a 30-second period for broad authenticator compatibility.

Integration test fixture

Generate an isolated secret key, record it only in protected test configuration, and never copy it into production.

Controlled internal tool

Add clear issuer and account labels, then scan the QR on managed devices under your organization’s access policy.

Offline handoff

Download the QR only when required, transfer it through an approved channel, and securely delete temporary files afterward.

FAQ

2FA secret key generator FAQ

Practical answers about TOTP secret key length, QR enrollment, storage, compatibility, and the important difference between creating a new secret and recovering an old one.

What is a TOTP secret key?

A TOTP secret key is a long-lived random value shared by an authenticator and the service that verifies its codes. It is commonly represented with Base32 characters and embedded in an otpauth URI or QR code. Anyone who obtains the secret key can generate future TOTP codes, so protect it like a password.

How does this 2FA secret key generator create randomness?

The 2FA secret key generator requests 20 random bytes from the browser Web Crypto API and encodes them as a 32-character Base32 value. That equals 160 bits of source entropy. The secret key generator does not derive keys from names, timestamps, Math.random, or a remote generation service.

What TOTP secret key length should I use?

This tool uses a 160-bit secret key by default, which becomes 32 Base32 characters without padding. It is a practical interoperable default for HMAC-SHA-1 TOTP enrollment. Longer keys are not automatically more compatible; follow your application’s authentication library and security requirements when you control both sides.

Can I generate a QR code from the new TOTP secret?

Yes. Each generated secret key is placed into a standard otpauth URI and rendered as a QR code in the browser. Add an issuer and account label before generation so the authenticator displays a useful name. You can scan the QR, copy the URI, or download a PNG for a controlled enrollment workflow.

Does the generator store the secret key or QR code?

No. The secret key, URI, and QR canvas remain in the current page workspace and are not written to LocalStorage, SessionStorage, cookies, URLs, or a server database. Clearing or reloading removes the workspace. Your browser, operating system, clipboard, or downloaded PNG may retain copies outside the page.

Can this tool recover my old Google Authenticator secret?

No. A secret key generator creates a new random secret and cannot recover a value previously issued by Google, GitHub, Facebook, or another provider. Replacing a secret also requires updating the verifying service. Use the provider’s backup codes, migration feature, or official account recovery process for a lost enrollment.

Which algorithm, digit count, and period should I choose?

Use SHA-1, six digits, and a 30-second period unless the application you are building explicitly requires other values. Those defaults are widely supported by authenticator apps. If you choose SHA-256, SHA-512, seven or eight digits, or another period, both the authenticator and server verifier must use exactly the same parameters.

Is a TOTP secret the same as a backup code?

No. A TOTP secret key continuously produces new time-based codes and usually remains valid until enrollment is replaced. A backup code is a separate one-time recovery credential issued by the account provider. Do not use this secret key generator to invent backup codes; the provider must create and recognize those values.

Can I use one secret key for multiple accounts?

Technically multiple systems could share a secret, but production accounts should receive independent secret keys. Reuse expands the impact of one leak and makes rotation or revocation harder. Generate a fresh secret key for each user, account, environment, or relying service, and store the server-side copy with appropriate encryption and access controls.

How do I test the generated TOTP secret?

Enroll the QR or otpauth URI in a trusted authenticator, then generate a TOTP code and test it against your application’s verifier. You can also use the local TOTP verifier on this site for a controlled consistency check. Complete verification before deleting the only copy, and never test a production secret in an untrusted environment.

Create carefully

Generate a new secret key and complete enrollment

Label the account, create the secret with Web Crypto, scan the QR, verify a code, and move the server copy into protected storage.

Open the 2FA secret key generator