TOTP Generator & Validator
Generate and verify time-based one-time passwords from a secret.
······
Expires in 0s
otpauth://totp/SkyK%3Auser%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=SkyK&algorithm=SHA1&digits=6&period=30 Send this to the QR generator to make a scannable enrolment code.
Validate a code
About the TOTP Generator & Validator
Generate time-based one-time passwords from a Base32 secret exactly as an authenticator app would, and verify submitted codes with tolerance for clock drift. Useful when building or debugging two-factor authentication, where the usual failure is a server and phone that disagree about the time.
How to use it
- 1 Paste an existing Base32 secret, or generate a new one.
- 2 The current code appears with a countdown to when it expires.
- 3 Adjust digits, period or algorithm if your implementation differs from the defaults.
- 4 Use the validator to check whether a code your server received would have been accepted.
What it does
- RFC 6238 TOTP with RFC 4226 HOTP underneath
- 6 or 8 digits, configurable period, SHA-1/256/512
- Live countdown to the next code
- Validator with configurable clock-skew window
- Generates the otpauth:// URI for enrolling a device
Frequently asked questions
Why is my code rejected even though it looks right?
Almost always clock drift. TOTP derives the code from the current time divided into 30-second steps, so a server whose clock is more than a step out of sync will compute a different code. Servers normally accept one step either side; if yours does not, fix the clock with NTP rather than widening the window.
Why must the secret be Base32 and not Base64?
RFC 6238 does not mandate an encoding, but every authenticator app settled on Base32 because its alphabet excludes 0, 1 and 8 — the characters most easily misread when a user types a secret by hand. Pasting a Base64 secret produces valid-looking but wrong codes.
Should I use SHA-256 instead of SHA-1?
Only if both sides support it. TOTP's use of SHA-1 is not a security weakness here — HMAC-SHA1 remains sound even though SHA-1 collisions are broken — and most authenticator apps ignore the algorithm parameter and assume SHA-1. Changing it is the fastest way to get codes that never match.
Is it safe to paste a real TOTP secret here?
Everything runs in your browser and nothing is transmitted. That said, a TOTP secret is a permanent credential — anyone holding it can generate valid codes forever. Prefer a test secret, and rotate any real one you have pasted into a tool you do not control.
What is the otpauth:// URI for?
It is what a QR code in an enrolment screen actually contains. It bundles the secret, issuer, account name and parameters so an authenticator app can add the account in one scan.