TOTP generator
A development authenticator: current code with countdown, adjacent windows, and the otpauth URI and QR code for enrolment.
One-time passwords you can test
Time-based one-time passwords (TOTP) are the six-digit codes in Google Authenticator, Microsoft Authenticator, Authy and 1Password. If you build login for an application, you also build the other half: generating a secret, showing a QR code, and checking the codes. Testing that means having a second device or an app on hand, which is slow in automated tests and awkward on a CI server.
This tool is a software authenticator for development. Enter a Base32 secret (or generate a random one), pick the digits, period and hash algorithm, and it shows the current code with a countdown, plus the codes for the previous and next windows so you can see how clock drift behaves. It builds the otpauth:// URI and a scannable QR code for enrolling a real app. The implementation follows RFC 4226 and RFC 6238 and is verified against the test vectors published in those documents.
Implementation notes for your server
- Generate secrets with a cryptographically secure random generator; 160 bits (20 bytes, 32 Base32 characters) is the usual size.
- Accept one window either side of the current one, no more, and remember the last accepted counter to reject replays.
- Rate-limit attempts: six digits is only a million possibilities.
- Store secrets encrypted, and offer recovery codes. Prefer WebAuthn passkeys where you can: TOTP can be phished.
Codes are produced with the browser's Web Crypto HMAC. The secret never leaves the page, and it is deliberately not stored in the shareable link.
Frequently asked questions
How do authenticator apps work?
The server and the app share a secret. Every 30 seconds both compute HMAC(secret, floor(time / 30)) and take six digits from the result (RFC 6238, built on HOTP from RFC 4226). If the digits match, you proved you hold the secret, and no code is ever sent over the network.
Why does my code not match the server?
Almost always clock drift: both sides must agree on the time within the period (servers usually accept the previous and next code). Other causes are a different period or digit count, a different hash (SHA-1 is the default almost everywhere), or a mistyped secret.
Is it safe to paste a real secret here?
The computation runs in your browser and nothing is sent anywhere, but a real production secret should not be pasted into any website, including this one. Use this tool with test accounts and development secrets.
What is the otpauth URI?
A standard format (otpauth://totp/Issuer:account?secret=...&issuer=...) that authenticator apps read from a QR code. The tool builds it and draws the QR code locally.