A TOTP secret used for two-factor authentication is typically encoded in the base32 format. Below is one way to generate a random base32 secret, for example to be provisioned to authenticator apps through QR codes and the Key-Uri-Format popularised by Google.
$ brew install coreutils
$ dd if=/dev/urandom bs=30 count=1 2>/dev/null | base32
dhk 