TOTP Secret Key Generator
Generate a secure, random base32 secret key for setting up 2FA on your app or service. Everything runs in your browser — nothing is sent anywhere.
Paste the generated key into 2faco.com to verify it generates valid TOTP codes before using it in production.
🎲 Cryptographically Secure
Uses crypto.getRandomValues() — the same API used by browsers for TLS key generation. Not Math.random().
🔒 Never Leaves Your Browser
The secret key is generated entirely client-side. Nothing is sent to any server, logged, or stored.
✅ RFC 6238 Compatible
Output is valid base32 as required by the TOTP standard. Works with Google Authenticator, Authy, and all major apps.
Frequently Asked Questions
What is a TOTP secret key?
A TOTP secret key is a shared secret exchanged once between your authenticator app and the service you're protecting. It's used to generate time-based codes that change every 30 seconds. The secret itself never needs to be transmitted again after setup.
How long should my secret key be?
The TOTP standard (RFC 4226) recommends at least 16 bytes (128 bits) — which is 26 base32 characters. 32 characters (160-bit) is the most common choice and provides excellent security. For highly sensitive systems, 52 characters (256-bit) is available.
What format should the secret key be in?
TOTP secret keys must be base32-encoded — they use only uppercase letters A–Z and digits 2–7. No padding characters (=) are needed by most authenticator apps. Remove spaces before storing or using the key programmatically.
How do I use this key?
When implementing 2FA in your app, store this secret securely per user. Display it to them as a QR code (using the otpauth:// URI format) or as a string they can manually enter into their authenticator app. Use an otpauth:// URI builder to generate the QR code.
How does the generator produce random characters?
Each character is drawn from the 32-character Base32 alphabet using crypto.getRandomValues() — the same cryptographically secure random source browsers use for TLS key generation, not Math.random(). Every character position is independent, so a 32-character key carries 160 bits of entropy and a 52-character key carries 256 bits.
Where should I store the generated secret?
Store it in your backend database, tied to the user account, and encrypt it at rest. Your server needs the original secret to verify every future TOTP code, because validation re-derives the code from the secret rather than reading it back from the user's app. Never store it in browser storage or embed it in client-side code.
What happens if a user loses access to their authenticator app?
TOTP secrets cannot be recovered from the app itself — if the app is gone, the codes are gone. That is why you should issue recovery codes at enrollment, and why a lost phone is handled by letting the user re-enroll with a fresh secret. Rotate the old secret immediately after re-enrollment so the old device stops working.
Can I reuse the same secret for multiple users?
No. Every account should have its own unique secret. Sharing one key between accounts means a single leak compromises all of them, and resetting one user's 2FA would break every other account using the same secret. Generate a fresh key for each enrollment.
How to use the TOTP secret key generator
- Choose a key length. The default is 32 Base32 characters (160 bits), which matches what most services and authenticator apps use. Use 26 characters (128 bits) for lower-security systems or 52 characters (256 bits) where you want extra margin. The tool updates the entropy badge so you can see the strength of your choice.
- Generate the key. Press "Generate New Key". The random output is produced with the Web Crypto API, so it is cryptographically strong rather than merely random-looking.
- Copy it, then store it securely. Use the Copy button and save the secret in your backend, encrypted at rest, associated with the user account. The server needs it to verify every future login code. If you enabled "Include spaces" for readability, the spaces are stripped automatically when you copy.
- Test it before production. Paste the key into the 2faco TOTP code generator to confirm it produces valid 6-digit codes, then build an otpauth:// URI so users can enroll by scanning a QR code instead of typing the secret manually.
How TOTP secrets work behind the scenes
A TOTP secret is a shared secret: the authenticator app and your server both store the same Base32 string, and both independently derive the same 6-digit code from it. The algorithm (RFC 6238) takes the secret, the current time divided into 30-second windows, and applies HMAC-SHA1 to produce a code that changes every window. Because both sides run the same calculation, verification works without any communication between them.
Base32 is used for the secret because it is human-friendly: the alphabet avoids confusing characters, keys survive phone keypads and manual entry, and QR codes encode them reliably. The length of the key directly determines its strength, which is why the generator measures entropy in bits — 5 bits per character, so 32 characters equals 160 bits of randomness.
The security model has one important implication: the secret is the only thing an attacker needs to generate your codes, so it must never appear in logs, URLs, browser storage, or client-side code. Treat it with the same care as a password, and rotate it if it is ever exposed — a leaked TOTP secret completely defeats the second factor.