TOTP Generator (2FA code tester)
Free TOTP generator for testing 2FA: enter a Base32 secret, see the live 6-digit code and countdown, verify a code and build or read otpauth:// URIs.
How to use TOTP Generator
- 1Enter a Base32 secret, paste an otpauth:// link, or press Generate a new random secret.
- 2Choose the algorithm, digits and period if your service does not use the defaults (SHA-1, 6 digits, 30 seconds).
- 3Copy the current code, or type a code into Verify to see which time step it matches.
What makes it better
- Live code with a countdown bar and a preview of the next code
- SHA-1, SHA-256 and SHA-512 with 6, 7 or 8 digits and 15, 30 or 60 second periods
- Verify a code with a one-step tolerance and see which step matched
- Reads an otpauth:// URI into every option, or builds one from your settings
- Random secrets use the browser's secure random generator; nothing leaves your device
About TOTP Generator
TOTP Generator turns a Base32 secret into the six-digit code that authenticator apps show, following RFC 6238 and RFC 4226. It displays the current and next code with a countdown, checks a code you type within one step either side, and reads or builds otpauth:// links so you can see exactly how an app is configured. It is meant for testing your own two-factor setup, with random test secrets created on your device.
Common uses
- Check that your server's two-factor code verification accepts the code an authenticator app would show.
- Debug a clock-drift problem by seeing which time step a user's code actually belongs to.
- Build the otpauth:// link that a QR code for enrolment should contain.
- Write automated tests with a fixed secret and a fixed time and compare against known codes.
Example
Input
GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
Result
287082
Good to know
- This tool is for testing. Do not paste the secret of a real account into any website, including this one; your phone's authenticator remains the real source of codes.
- Codes depend on your device clock. If it is several seconds off, codes will not match a server whose clock is correct.
- SHA-1 is the default because nearly every authenticator app expects it; some apps ignore the algorithm, digits or period in a link and always use the defaults.
TOTP Generator FAQ
How does a TOTP code get calculated?
The current time is divided by the period (30 seconds by default) to get a counter. That counter is signed with HMAC using the secret, and a few bytes of the result are reduced to the number of digits wanted. Both sides repeat this, so they agree without talking to each other.
Why does my TOTP code not match the server?
Most often the clocks differ, the secret was copied with a typo, or the service uses different settings than the defaults. Use Verify to test a code against the steps before and after the current one, and check the algorithm, digits and period.
What goes into an otpauth:// URI?
It holds the account label, the issuer and the secret, and optionally the algorithm, digits and period. QR codes shown during two-factor setup are simply this text. Paste one here and every option on the page is filled in.
Why is the Base32 secret rejected?
Base32 uses only the letters A to Z and the digits 2 to 7, optionally padded with equals signs. Digits 0, 1, 8 and 9 and symbols are not allowed, and the length must be possible for whole bytes. Spaces and dashes are ignored.
Is a 6-digit code strong enough on its own?
It is a second factor, not a replacement for a password. A code is valid for only a short window and a server should limit attempts, but it can still be phished in real time, so phishing-resistant methods such as passkeys protect better.