TOTP Generator and Validator
Generate the current TOTP code for a secret, and check a code someone gave you.
Runs entirely in your browser.
Generate and Check Time-Based One-Time Passwords
Check a code
About TOTP Generator and Validator
TOTP is what authenticator apps produce. The secret and the current time are run through HMAC, the result is truncated to six digits, and both ends compute the same number without ever exchanging it. The clock is divided into 30-second steps, so the code changes twice a minute.
This is here for building and debugging two-factor login: check that your server derives the same code as the app, work out whether a mismatch is a clock problem or a secret problem, and see what the otpauth:// URI behind a setup QR code actually contains.
The implementation is checked against all eighteen test vectors in RFC 6238 - SHA-1, SHA-256 and SHA-512 - so a disagreement between this page and your server is a bug in the server, not here.
Nothing is sent anywhere; the HMAC runs in your browser. That said, a real production secret is worth treating carefully wherever you paste it, so use the random secret button while you are testing.
Other Security Tools
- ULID Generator — sortable unique identifiers
- Basic Auth Header Generator — build or read an Authorization header
- UUID Generator — random and time-based UUIDs
- Token Generator — secure random tokens
- HMAC Generator — sign a message with a key
- Hash Generator — MD5, SHA-1, SHA-256 and more
- Bcrypt Hash Generator — hash and verify passwords
- JWT Decoder — inspect a token
- JWT Signer — create and sign a token
- Password Generator — strong random passwords
- Base32 Encode / Decode — the encoding TOTP secrets use
