TOTP Code Generator and Checker
Enter a Base32 secret, or paste an otpauth link, and see the current one-time code with a countdown to the next one, along with the previous and next codes. Switch to Check mode to test whether a code is valid for a secret. You can also set the time yourself to reproduce the test values in the standard. Everything runs in your browser.
A time-based one-time password, or TOTP, is the six digit code in an authenticator app. The app and the server share a secret key. Each 30 second step, both work out an HMAC of the step number using that key and cut it down to a few digits, so they agree on the code without sending it. The method is defined in RFC 6238, built on the HOTP method in RFC 4226. Because it needs only the secret and the clock, this tool can reproduce any authenticator code, so a secret must be kept private.
Related Tools
[5 suggestions]HMAC Generator (SHA-1, SHA-256, SHA-384, SHA-512)
Create an HMAC signature for a message and secret key with SHA-1, SHA-256, SHA-384 or SHA-512, as hex or Base64, and check a signature you were given.
Developer & WebHash Generator (MD5, SHA-1, SHA-256, SHA-512)
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hashes live from any text using the native Web Crypto API.
Developer & WebPassword Generator
Generate cryptographically secure random passwords with custom length and character sets.
Developer & WebBase32 and Base58 Encoder and Decoder
Encode text or hex to Base32 (RFC 4648, extended hex or Crockford) or Base58, or decode it back, with padding options and byte counts.
Developer & WebUnix Timestamp & Epoch Converter
Convert Unix epoch timestamps to UTC and local dates, or convert human dates to Unix timestamps with auto-detection.
Developer & WebAbout the TOTP Code Generator and Checker
A time-based one-time password, or TOTP, is the six digit code an authenticator app shows and that changes every 30 seconds. It is defined in RFC 6238, which builds on the counter-based HOTP method of RFC 4226. The app and the website share a secret key, usually shown as a Base32 string or a QR code. To make a code, both take the number of 30 second steps since 1 January 1970, calculate an HMAC of that number with the secret, and cut a few bytes out of the result to get a number of 6 to 8 digits. Because both sides work from the clock and the secret, no code travels in advance. The standard uses SHA-1 by default and also allows SHA-256 and SHA-512, and the otpauth link that a QR code holds names the algorithm, digits and period. The RFC's test secret is the 20 characters 12345678901234567890, which is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ in Base32, and at Unix time 59 it gives the 8 digit code 94287082. Servers usually accept the codes from one step either side of the current one to allow for slightly wrong clocks, so Check mode has a window setting. Anyone who has the secret can make valid codes, so a real secret should never be pasted into a website. Use a test secret, and keep real ones in your authenticator app.
How does a TOTP code work?▾
The app and the server share a secret. Every 30 seconds each works out an HMAC of the current time step using that secret and turns it into a short number. Because both get the same number, the server can check your code without it ever being sent beforehand.
Why does my code not work?▾
The most common cause is a wrong clock on your device or the server. Codes are only valid for their 30 second step, though servers often accept one step either side. A mistyped secret or a different digit count or algorithm will also give different codes.
What is a Base32 secret key?▾
It is the shared secret written in Base32, using the letters A to Z and the digits 2 to 7. Authenticator apps show it when you cannot scan the QR code. It is the same data that the QR code carries.
Is it safe to enter my 2FA secret here?▾
The tool works in your browser and sends nothing, but a secret is as good as a password for your account. Use test secrets here, and never share a real one.
Is my data uploaded?▾
No. The calculation runs in your browser and nothing you enter is sent anywhere.