TOTP Code Generator & Verifier (2FA)
Generates the same 6-digit codes (RFC 6238) that Google Authenticator and similar apps show, from a Base32 secret. Paste an otpauth:// URI to load its settings too. It is meant for debugging and testing an implementation, not as a replacement for an authenticator app. Everything runs in your browser, and your secret is never sent to a server. It is built on HMAC (see the HMAC Generator).
🔒 Runs in your browser · Your data is never sent to a server
Current code
Next code:
Notes
- Codes are computed from your device's current time. If your clock is off, the codes will not match the server's.
- Verification also accepts the code one step before and after the current one, to allow for clock drift.
- Avoid entering the secret of a real account; use a test secret instead. Nothing you type is stored or sent, but be careful when sharing your screen.
Glossary
TOTP
Time-based One-Time Password. A scheme that computes a single-use code from a shared secret and the current time, changing at a fixed interval such as every 30 seconds (RFC 6238).
Base32
An encoding that represents data with 32 characters, A-Z and 2-7. Secrets you register in an authenticator app are usually shown in this format.
otpauth:// URI
The URI embedded in a 2FA QR code, bundling the secret, issuer, digits, period, and so on. Authenticator apps read it to register an account.
FAQ
Why does the code not match what my server expects?
Clock drift is the usual cause. TOTP is computed from the current time, so being off by a few dozen seconds gives a different code. Also check that the algorithm (SHA-1 is the default), digits, and period match your implementation.
Where do I get an otpauth:// URI?
It is the content of the QR code shown on a 2FA setup screen. Scan the QR code with a reader and paste the resulting text here to fill in the secret, digits, and period automatically.
Can I use this instead of an authenticator app?
This tool is for debugging and testing an implementation. We do not recommend entering a real account secret to use it day to day, and the codes are gone as soon as you close the tab. Use an authenticator app for everyday logins.
Why are the previous and next codes also accepted?
Most services accept the code one step before and after the current one to tolerate small clock differences between device and server. The verifier here behaves the same way.
Share this page