Skip to main content
Bethemesh
Security & privacy

TOTP Generator & Verifier

Enter or generate a 160-bit Base32 secret, pick SHA-1, SHA-256 or SHA-512, 6 or 8 digits and the period: the current TOTP code refreshes with a countdown, the otpauth:// URI is ready for an authenticator app, and a code can be verified with a one-period tolerance.

  • Clipboard

Embed this widget

Customize the result, check the live preview, then copy the code.

Preview

Embed code type

Code to copy

Responsive and automatically resized by Bethemesh.

The shared key shown under the setup QR code (letters A-Z and digits 2-7).

Was this tool useful?

How does this tool work?

This tool computes TOTP one-time codes, the ones shown by Google Authenticator, Microsoft Authenticator or 1Password, from a Base32 secret. It helps developers who add two-factor authentication test their implementation, and helps admins check a secret or prepare an enrolment URI.

TOTP (RFC 6238) is the time-based variant of HOTP (RFC 4226). A counter T = floor(Unix time / period), 30 seconds by default, is fed into HMAC(secret, T) with SHA-1, SHA-256 or SHA-512. "Dynamic truncation" extracts 4 bytes of the HMAC at an offset given by its last 4 bits, and the result modulo 10^6 (or 10^8) is the code. RFC example: with the ASCII secret `12345678901234567890` (Base32 `GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ`), SHA-1 and time 59 s, the 8-digit code is 94287082.

The tool decodes the Base32 secret (or generates a 160-bit one, 32 characters, with crypto.getRandomValues), computes the current code with Web Crypto and refreshes it with a countdown to the next period. It builds the `otpauth://totp/Issuer:account?secret=…&issuer=Issuer&algorithm=SHA1&digits=6&period=30` URI that apps import, usually through a QR code. For verification, it compares the code you enter with those of the previous, current and next period, which absorbs a small clock drift.

How to use this tool

  1. Set the secret

    Paste a Base32 secret or generate a 160-bit one, then choose the algorithm (SHA-1, SHA-256, SHA-512), the number of digits (6 or 8) and the period (30 s by default).

  2. Read the code and URI

    The current code is shown with its countdown; enter the issuer and account name to get the otpauth:// URI to import into an app.

  3. Verify a code

    Type a code you received: the tool tells you whether it matches the current, previous or next period.

Use cases

Test a 2FA integration

You are building two-factor enrolment: generate a secret, import the URI into your authenticator app and check that your server accepts the same codes.

Debug rejected 2FA codes

Compare the expected code for a secret with the one in the user's app to tell a wrong secret, a wrong algorithm or a drifting clock apart.

Enrol a shared service account

Build the otpauth:// URI with the right issuer and account name, then turn it into a QR code for the team that has to register the account.

Tips and best practices

  • For maximum app compatibility keep SHA-1, 6 digits and 30 seconds: some apps, Google Authenticator included, long ignored the algorithm, digits and period URI parameters.
  • Spaces and lowercase letters in a grouped secret ("jbsw y3dp …") do not change the Base32 value; a 0 or a 1, however, is not part of the Base32 alphabet and points to a typo.
  • Server-side, reject reuse of a code that was already accepted during its validity window, as RFC 6238 recommends: the one-period tolerance must not allow replaying a code.

Frequently asked questions

Why is my TOTP code not working?

The most common cause is a clock that is off on the phone or the server: a few dozen seconds are enough to switch periods. Next come a mistyped secret and an algorithm, digit count or period different from what the service expects. Turn on automatic time, then compare this tool's code with the app's.

What is the difference between TOTP and HOTP?

HOTP (RFC 4226) derives the code from a counter incremented on every use, which must stay in sync between client and server. TOTP (RFC 6238) replaces that counter with time divided into 30-second periods, so the code expires by itself. Nearly all consumer 2FA apps use TOTP.

Where do I find the TOTP secret key?

The service shows it when you enable 2FA, below the QR code, often labelled "setup key" or "enter code manually". The QR code itself contains an otpauth:// URI whose secret parameter is that Base32 key. Once setup is complete, most services never show it again.

Can I use SHA-256 or 8 digits with Google Authenticator?

It is not guaranteed: the historical key URI documentation states that Google Authenticator ignored algorithm, digits and period, producing 6-digit SHA-1 codes that then do not match. Apps such as 1Password or Authy accept SHA-256 and SHA-512. For a public service, 6-digit SHA-1 remains the compatible choice, and it is secure in the HMAC construction.

How long is a TOTP code valid?

A code belongs to one period, 30 seconds by default. Many servers, like this tool when verifying, also accept the previous and next period to cover latency and clock drift, which gives an effective window of about 90 seconds.

Is it risky to paste my 2FA secret into an online tool?

The secret generates all your future codes: whoever holds it has your second factor. Here, the computation happens only in your browser with Web Crypto and nothing is transmitted. Still, avoid pasting the secret of a real production account on a shared device; a test secret is the better choice.

Related tools

Keep going with these tools

Tools similar or complementary to this one.

Works well with

Secure token generator

Generate secure random tokens from 8 to 256 bytes in hex, Base64 or Base64URL, with an optional prefix.

Security & privacyNewUse this tool

HMAC Generator and Verifier

Compute an HMAC-SHA-1, SHA-256, SHA-384 or SHA-512 in hex or Base64 and verify a webhook signature.

Security & privacyNewUse this tool

Password generator

Generate strong random passwords from 8 to 128 characters, with the entropy shown.

Security & privacyFeaturedUse this tool

Read next