Start a project

Tool 92 of 100 · Security

TOTP & 2FA Code Generator

Test your app's two-factor login: create a secret, see the current code count down, check a code against nearby time steps, and build the otpauth link.

Use the tool All developer tools Live · free
TOTP & 2FA Code Generator at a glanceIllustration: 1, A secret; 2, processed in your browser; 3, 6-digit codes.TOTP & 2FA Code Generator1A secret36-digit codes2In yourbrowser
1 A secret 2 processed on your device 3 6-digit codes

TOTP & 2FA Code Generator

Secret and settings

Current code

------

otpauth:// link (paste into the QR code generator to make a scannable code)

Check a code

Read an otpauth:// link

Use test secrets only. A real account's secret is as sensitive as its password.

01

What it does

Makes RFC 6238 time-based and RFC 4226 counter-based one-time codes, generates secrets, and reads and writes otpauth links.

  • RFC 6238 TOTP and RFC 4226 HOTP
  • SHA-1, SHA-256 and SHA-512; 6 to 8 digits
  • New Base32 secrets from the browser's secure random source
  • Read and write otpauth:// links

02

Private by design

Everything happens in your browser. Nothing you type, paste or upload is sent anywhere, and it keeps working offline once the page has loaded.

03

What you get

Codes, a secret and an otpauth:// link, with a Copy and a Download button on every result.

  • 2FA
  • TOTP
  • Security
  • Testing

Why it matters

Building or debugging two-factor login means comparing codes: is the server's clock off, is the secret decoded correctly, is the period or algorithm different from the app's? An authenticator app on your phone can't tell you any of that.

This generator uses the browser's WebCrypto to compute the same codes as Google Authenticator, 1Password and others, shows which time step you're in, and checks a code against nearby steps. It's for testing; keep real account secrets in a proper authenticator.

How it works

  1. InputA Base32 secret or an otpauth link
  2. In your browserHMAC with WebCrypto (RFC 6238)
  3. OutputCurrent codes, a QR link and a verifier

Where it fits in a designer's workflow

  1. Plan
  2. Design
  3. Build
  4. Test
  5. Launch
Testing two-factor login.

By the numbers

RFC 6238 test vectors, generated by this toolT = 59 s: 94287082 = RFC; T = 1,111,111,109 s: 07081804 = RFC; T = 1,111,111,111 s: 14050471 = RFC; T = 1,234,567,890 s: 89005924 = RFC; T = 2,000,000,000 s: 69279037 = RFCT = 59 s94287082 = RFCT = 1,111,111,109 s07081804 = RFCT = 1,111,111,111 s14050471 = RFCT = 1,234,567,890 s89005924 = RFCT = 2,000,000,000 s69279037 = RFC
The tool's own code given the RFC's SHA-1 test key at each test time, 8 digits, 30-second steps. Every code matches the published value, so codes from this tool match any standard authenticator app. Source: RFC 6238 appendix B.
Show the numbers as a table
Time (Unix seconds)ToolRFC 6238
599428708294287082
11111111090708180407081804
11111111111405047114050471
12345678908900592489005924
20000000006927903769279037

How to use it

  1. Make a new secret, or paste one or an otpauth link.
  2. Set the algorithm, digits and period to match your server.
  3. Compare the current code with your app's.
  4. Check a code to see which time step it belongs to.

FAQ

Why doesn't my code match?

Usually the clock (check your device's time), the algorithm (most apps only support SHA-1) or the period (normally 30 seconds).

Is the secret sent anywhere?

No. Codes are computed in your browser. Even so, don't paste secrets for real accounts into any website.

Can I scan a QR code with it?

It writes the otpauth:// link. Turn it into a QR code with the QR Code Generator to scan it with an app.

What's the drift window?

How many 30-second steps either side of now a server accepts. One step either way is common.

Work with me

Want a site that gets these right?

I build fast, accessible websites and web apps that pass these checks from day one. Tell me about your project and I'll reply personally with honest next steps.

Start a project What I do

All developer tools · Back to leej.uk