TOTP / 2FA Code Generator & Validator
Paste a Base32 secret or an otpauth:// link to see the current two-factor code, the previous and next codes and how long the current one has left. You can check a code against a time window to measure clock drift, or create a new random secret with a QR code for Google Authenticator, Authy, 1Password and similar apps. The codes are calculated in your browser with the Web Crypto API (RFC 6238 and RFC 4226), and the secret is not sent anywhere or saved.
Check a code
New secret and QR code
How to use
- Paste the secret key in Base32 (the letters-and-digits key a site shows under "can't scan the QR code?") or a whole otpauth:// link. Choose Hex under Secret format if your secret is hexadecimal.
- If you pasted a link, the type, algorithm, digits, period, issuer and account fill in automatically. Otherwise leave the defaults (TOTP, SHA-1, 6 digits, 30 seconds), which almost every service uses.
- The current code appears with a bar showing the seconds it has left, plus the previous and next codes. Click Copy code to copy it.
- To check a code, type it under Check a code, choose how many time steps either side to allow and click Check code. The result says which time step matched, so you can see how far apart two clocks are.
- For HOTP, set the counter. Check code looks ahead from that counter and reports which counter matched.
- To set up a test account, click Generate new secret, enter an issuer and account name, then click Show QR code and scan it with your authenticator app. Compare the app's code with the one shown here, and download the QR code as PNG if you need it.
Examples
Base32: GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ Time step: 1 Code: 94287082
SHA-256: 46119246 SHA-512: 90693936
755224, 287082, 359152, 969429, 338314
otpauth://totp/Example%20Co:alice%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example%20Co
Supported formats
- Secret: Base32 (RFC 4648, A–Z and 2–7) with or without spaces, dashes and = padding, in any case; or hexadecimal.
- URI: otpauth://totp/Issuer:account?secret=… (or otpauth://hotp/…) in the Key URI format used by Google Authenticator and most other apps, with the optional parameters issuer, algorithm (SHA1, SHA256 or SHA512), digits (6, 7 or 8), period (seconds) and, for HOTP, counter.
- Codes: RFC 6238 TOTP and RFC 4226 HOTP with HMAC-SHA-1, HMAC-SHA-256 or HMAC-SHA-512, 6 to 8 digits, any period from 1 second to a day.
- QR code: PNG of the otpauth:// link, black on white, error correction M. New secrets are 20, 32 or 64 random bytes from crypto.getRandomValues().
- Generated links leave out algorithm, digits and period when they are the defaults (SHA1, 6, 30), because some apps handle those parameters badly.
Privacy
Your input is processed in your browser and is never uploaded. The first time you use the tool, your browser downloads its open-source processing library from cdnjs.cloudflare.com — the library is downloaded, your data is not sent. Privacy policy.
Limitations
- TOTP codes are only right if this device's clock is right. The page shows the clock but cannot check it against a time server without sending a request, so it does not.
- Many authenticator apps, including Google Authenticator, support only SHA-1, 6 digits and a 30-second period and silently ignore other values in the QR code. Check your app before relying on other settings.
- This tool does not handle Steam Guard codes, Yandex/mOTP or other non-standard schemes, or otpauth-migration:// export links from Google Authenticator.
- The page keeps the secret only in memory while the tab is open. It cannot protect a secret from browser extensions or anyone who can see your screen; use test secrets where you can.
- In a link, a + in the issuer or account is read as a space, as most generators intend; write %2B for a literal plus.
FAQ
Is it safe to paste my 2FA secret here?
The secret is used only by the Web Crypto API in this tab: nothing is uploaded, logged or saved, and it disappears when you close the page. Even so, anyone with the secret can make your codes, so treat it like a password. Use this tool for test accounts, for your own development, or to check a backup of your own secret on a device you trust.
Why does my code not match the one in my authenticator app?
Usually one of the two clocks is off, or the settings differ. Turn on automatic time on both devices, check that the algorithm, digits and period match the QR code you scanned, and use Check a code with a window of 1 or 2 to see whether the app is a step ahead or behind. A secret copied with a wrong character also gives completely different codes.
What is the difference between TOTP and HOTP?
HOTP (RFC 4226) makes a code from the secret and a counter that goes up each time a code is used. TOTP (RFC 6238) is the same calculation with the counter replaced by the current time divided into steps, usually 30 seconds, so codes change on their own. Most apps and sites use TOTP.
What window should a server allow?
RFC 6238 recommends allowing at most one time step either side of the current one to cover clock drift and typing time. Wider windows make guessing easier. A server should also refuse a code that has already been used.
How long should a secret be?
RFC 4226 requires at least 128 bits and recommends 160 bits (20 bytes), which is the default here and what most services use. Longer secrets of 32 or 64 bytes match the SHA-256 and SHA-512 test vectors in RFC 6238 but are not supported by every app.
How are the issuer and account written in the otpauth link?
The label is the issuer and account joined by a colon, each percent-encoded, for example otpauth://totp/Example%20Co:alice%40example.com, and the issuer is repeated in the issuer parameter. Apps use them only to name the entry, so they do not change the codes.