OTP Code Generator and Validator

Generate and validate TOTP codes compatible with Google Authenticator and other authenticator apps.

OTP Code Generator and Validator tool

Loading...

Example

Input: Open the Generate tab (a new Base32 secret is created automatically)

Result: A 32-character Base32 secret, a QR code for authenticator apps and a 6-digit code that changes every 30 seconds

The code is HMAC-SHA1 of the current 30-second time step, truncated to 6 digits. With the RFC 6238 test secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, Unix time 59 gives 287082.

RFC 6238 Test Values (6 Digits)

Unix timeUTC timeTime stepCode
591970-01-01 00:00:591287082
11111111092005-03-18 01:58:2937037036081804
11111111112005-03-18 01:58:3137037037050471
12345678902009-02-13 23:31:3041152263005924
20000000002033-05-18 03:33:2066666666279037
200000000002603-10-11 11:33:20666666666353130

Computed with this tool algorithm for secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ; each is the last 6 digits of the RFC SHA-1 value.

  1. In Generate mode, use the random Base32 secret created for you, or click "Generate New Secret".
  2. Enter an issuer and account name to label the entry in authenticator apps.
  3. Watch the current code and the countdown to the next one.
  4. Scan the QR code with Google Authenticator or another TOTP app to add the account.
  5. To check a code, switch to Validate, enter the Base32 secret and the 6-digit code, and click "Validate Code".

How TOTP Codes for Authenticator Apps Work

This tool creates a TOTP secret and shows its live 6-digit code with a countdown. It also makes a QR code you can scan into Google Authenticator, Microsoft Authenticator, Authy or similar apps. A Validate tab checks whether a code matches any Base32 secret you enter.

TOTP (time-based one-time password, RFC 6238) needs only two things: a shared secret and the clock. Every 30 seconds, your app and the server each count the 30-second steps since 1970. They run that number through HMAC-SHA1 with the secret and cut the result down to 6 digits. The two sides never talk to each other, which is why codes work on a phone in airplane mode. It also means a phone clock that is a minute or more off can produce codes the server rejects.

New secrets are 32 Base32 characters (the letters A to Z and the digits 2 to 7), which is 160 bits, the size RFC 4226 recommends. The QR code holds an otpauth:// link with your issuer and account name. It also sets SHA1, 6 digits and a 30-second period, the settings nearly every app expects. The validator accepts the previous, current and next code to allow for clock drift.

Developers use the tool to test 2FA sign-up and login, or to find out why codes never match. Common causes are a secret copied with a typo or a server clock out of sync. A library set to a different period or number of digits is another. The tool can only make codes for a secret you already hold, so it cannot get anyone past 2FA on an account they do not control.

Everything runs in your browser. Still, treat a TOTP secret like a password, because anyone who has it can make valid codes. Avoid pasting secrets for important real accounts into any website. For other random secrets, try the Token Generator.

Sources

Frequently Asked Questions

The most common cause is a wrong clock. TOTP depends on the time, so turn on automatic date and time on your phone and check the server clock too. Other causes are a secret entered with a typo, or a service that expects 8 digits or a 60-second period instead of the usual 6 digits and 30 seconds.
Yes. The QR code uses the standard otpauth:// format with SHA1, 6 digits and a 30-second period, which Google Authenticator, Microsoft Authenticator, Authy and most password managers support. After you scan it, the code in your app should match the code shown here, changing at the same moment.
Both come from the same idea. HOTP (RFC 4226) makes a new code each time a counter goes up, for example on each button press. TOTP (RFC 6238) uses the current time step as the counter, so codes expire every 30 seconds. This tool makes and checks TOTP codes only, which is what nearly all apps use today.
Only if you still have the original secret, for example from a saved setup key. Without the secret, no tool can make valid codes, which is the whole point of 2FA. Use the backup codes the service gave you when you set up 2FA, or its account recovery process, and set up 2FA again on your new phone.
Base32, which uses the letters A to Z and the digits 2 to 7. Services show it as the setup key under the QR code, often in groups of four. You can paste it with spaces or in lowercase, because the validator ignores anything that is not a Base32 character. The validator cannot read QR code images.

Related Tools

Password Generator

Generate strong, secure passwords with customizable length, character types, and multi-word passphrases.

Security and Encryption

Token Generator

Generate random tokens and strings in hex, alphanumeric, URL-safe, and custom character set formats.

Security and Encryption

Hash Generator

Create MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, right in your browser.

Security and Encryption

HMAC Generator

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512 with custom secret keys for message authentication.

Security and Encryption

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption