Using TOTP
Online TOTP generator: safety checks
Use an online TOTP generator with care: match the service settings, protect the setup secret, and know when a dedicated authenticator is a better fit.
Know what an online TOTP generator needs
A TOTP generator needs the same setup information held by an authenticator app: a shared secret, a time period, a digit count, and sometimes an algorithm choice. It calculates the code from those values and the current time; it does not ask the account provider for a code.
That convenience makes the setup secret especially sensitive. Before using an online tool, check that the page explains where calculation happens and that the browser is on the expected domain. Do not use a link sent by an unexpected message.
Use it as a focused utility
An online TOTP generator can help you verify a configuration, use an otpauth setup link, or produce a code on a trusted device. Keep the activity focused: do not turn a temporary web page into an informal store for many account secrets.
When a code is rejected, first check the device clock, the account label, and the configuration details. Re-enrol through the service's authenticated security settings instead of sending the secret to someone who claims to diagnose the problem.
Keep a stronger recovery plan
For high-value accounts, use passkeys or hardware security keys where the provider supports them. For TOTP accounts, retain protected backup codes and, if appropriate, a second trusted device or encrypted backup. Those choices are more important than any individual generator interface.
Never assume that access to a current code solves account recovery. A lost phone, a changed recovery email, or a missing backup code can still matter, so review the recovery path before it is urgent.
Choose between passkeys and TOTP · Build a safer backup-code plan