2FA Code Generator (TOTP)

This is a workbench for anyone building or debugging two-factor sign-in. Paste a Base32 secret or a full otpauth:// link and you get the same six- or eight-digit codes an authenticator app would show, refreshed live with a countdown ring. It handles both kinds of one-time password: TOTP, where the code changes every 30 or 60 seconds, and HOTP, where it changes each time a counter goes up.

The most common 2FA bug is “the code is always wrong”, and the cause is usually a clock that is a little out, a secret copied wrongly or a mismatched setting. So the tool shows the codes for the steps either side of now, lets you type in a code from an app or server to see exactly which time step or counter it belongs to, and explains bad Base32 characters in plain words. You can also generate a fresh random secret and get its otpauth:// link and QR code to scan into a test phone.

Please use it only with test accounts. The secret is the whole lock: never paste one that protects a real account into any website. Here, every code is calculated with your browser’s built-in cryptography, and nothing is stored or sent.

1. Paste a Base32 secret or an otpauth:// link into the top box, or press “New random secret” to make one.
2. Check the settings match your server: TOTP or HOTP, the algorithm, 6 or 8 digits, and a 30 s or 60 s period (or the counter for HOTP). A pasted link fills these in for you.
3. Read the current code, watch the ring count down, and press Copy when you need it.
4. If a code is rejected, type it into “Check a code” to see whether it belongs to an earlier or later step.
5. To try a secret on a phone, fill in Issuer and Account, then scan the QR code or press “Download QR (PNG)”.

• TOTP (RFC 6238) and HOTP (RFC 4226) codes, checked against the official test vectors.
• SHA-1, SHA-256 and SHA-512, 6 or 8 digits, and 30 or 60 second periods.
• Reads otpauth:// links, filling in the secret, issuer, account, algorithm, digits, period and counter.
• Secrets in Base32, hex or plain text, with clear messages for mistyped Base32 and secrets that are too short.
• Codes for two steps before and after now, and a code checker that looks 20 time steps either way (10 minutes at 30 s) or 15 counters ahead.
• New random secrets sized to the algorithm (160, 256 or 512 bits) from your browser’s secure random generator.
• otpauth:// link and black-on-white QR code to scan, copy or save as PNG.
• Shows your device’s clock in local time and UTC, since every TOTP code depends on it.

• Many authenticator apps, including Google Authenticator, ignore anything other than SHA-1, 6 digits and 30 seconds. Test unusual settings with the app your users actually have.
• If codes are always one step out, the server or phone clock is drifting. Turn on automatic time on both rather than widening the server’s accepted window a lot.
• Most servers accept the previous code as well as the current one, so a code typed just as the ring runs out usually still works.
• Base32 secrets are often shown in groups of four with spaces. Paste them as they are: spaces, dashes and lower case are fine.