THE PRACTICAL GUIDE · NORMANDIN SYSTEMS
Get more from OTP code generator
OTP code generator: Generate and validate time-based and event-based OTP (one time password) for multi-factor authentication. One-time password generation depends on a shared secret and a moving factor, which is time for TOTP and a counter for HOTP. Cryptographic operations depend on exact agreement about algorithms, keys, encodings, and message formats. A successful local demonstration is useful for understanding a workflow, but interoperability should be checked with the program or protocol that will consume the output. Keep secret material separate from public information and use disposable test keys while experimenting. Encryption, signing, and hashing answer different questions: confidentiality, authenticity, and data representation are not the same property. Record the relevant parameters and verify the reverse operation or verification result before relying on an output.
Guide updated October 13, 2026
How to use this tool
- Begin with a representative input. For a practical test, use: A disposable shared secret with time-based or counter-based settings. Replace demonstration values only after you understand the output.
- Use sample plaintext and disposable keys to select the operation and supply the key material or parameters requested by the interface.
- Inspect the result and any error message, checking algorithm choices, key formats, and whether the operation expects public or private material.
- Test decryption or verification with the intended receiving application and retain the parameters needed to reproduce that workflow.
SEE IT IN PRACTICE
A worked example
A disposable shared secret with time-based or counter-based settings
An OTP value or a validation result for the configured parameters
Treat the shared secret as the long-lived credential; a short code expiring does not make an exposed secret safe.
The moving factor explains the code
An OTP construction derives a short value from a shared secret and a changing input. TOTP derives that input from time steps; HOTP uses an event counter. A verifier may accept a limited window to accommodate drift or synchronization. The window is a security decision, not just a convenience setting. Test transitions near a time-step boundary rather than only a stable moment.
Provisioning is part of the security model
The shared secret enables future code generation, so exposing it is more serious than exposing one short-lived code. Keep provisioning material controlled and replace a compromised secret through the application’s recovery process. During integration tests, verify correct codes, incorrect codes, replay behavior, and clock or counter mismatches using disposable secrets. Successful generation alone does not test the verifier’s complete policy.
When this tool is useful
- Test an MFA integration
- Compare TOTP settings
- Inspect an HOTP counter example
Tips for a better result
- Time drift, counter mismatch, digit count, and algorithm differences can cause valid-looking codes to fail verification.
- Public keys may be distributed, while private keys and shared secrets require controlled storage and handling.
- An output that looks like encoded text is not enough to prove compatibility; test it with the actual receiving implementation.
Frequently asked questions
Why do two authenticators show different codes for the same secret?
They may differ in time step, clock, digit count, hash algorithm, or HOTP counter. Match the complete parameter set and distinguish time-based TOTP from counter-based HOTP.
Why does another application reject my output?
Common causes include different key containers, padding choices, algorithm versions, text encodings, or missing metadata. Compare the complete format and parameters rather than only the algorithm’s general name.
What is a useful end-to-end test?
Use disposable keys and a known sample message. Confirm that the intended receiver can decrypt or verify the result, then change the message or use an incorrect key to confirm that the expected failure is detected.
What happens to the information I enter?
The utility processes your input in this browser. Some tools retain field values in browser storage or the URL; avoid entering secrets in shareable fields. Page and asset requests still go to the hosting provider. Read the privacy and offline-use notes for details.