TOTP secret generator

Time-based one-time passwords work from a secret both the server and the authenticator app hold. This generates that secret: 160 random bits, base32-encoded without padding, which is the form every authenticator app expects.

The defaults in the URI — SHA-1, six digits, a thirty-second period — look dated, and they are, but they are what RFC 6238 specifies and what every mainstream authenticator implements. Deviating breaks compatibility for no security gain, because the secret’s 160 bits are what carries the strength here, not the hash. The one thing worth knowing about handling: the secret is a symmetric key. If your database leaks it, an attacker generates codes as easily as the user does, so it needs the same protection as a password hash and rather more than a session token.