TOTP / OTP Generator

Generate and verify time-based one-time passwords (TOTP) from a Base32 secret.

Secret (Base32)

DigitsPeriod (seconds)Algorithm

Verify a code

Overview

Generates a time-based one-time password (TOTP), compliant with RFC 6238, from a Base32 secret key. It works the same way as two-factor authentication apps like Google Authenticator or Authy.
The generated code automatically refreshes at the configured period (30 seconds by default).
Also includes a feature to verify whether an existing code is correct.

Usage

Enter an existing secret, or click "Generate random" to create a secret for testing.
Configure the number of digits, period, and hash algorithm if needed (the defaults — 6 digits, 30 seconds, SHA-1 — match Google Authenticator).
The current code is displayed automatically and keeps refreshing along with a countdown.
To verify a code, enter it in the field at the bottom and click "Verify".

Example

Input

Secret: JBSWY3DPEHPK3PXP

Output

A 6-digit code (refreshes every 30 seconds)

Use Cases

Checking whether an application implementing two-factor authentication (2FA) generates and verifies TOTP codes correctly
Testing the behavior of the secret used to build the QR code shown when setting up an authenticator app
Learning about and verifying how the TOTP mechanism (RFC 6238) works

FAQ

Is the generated secret stored securely?

Secret generation and code calculation happen entirely in your browser and are never sent anywhere. That said, we do not recommend entering or storing a production secret in this tool.

Will this produce the same code as Google Authenticator?

Yes, as long as the same secret, digit count (6), period (30 seconds), and algorithm (SHA-1) are used.

Can a code still be verified if there is a slight clock drift?

Yes. Verification allows for a drift of one step before or after (30 seconds either way, with the default settings).