Paste a Base32 secret key to see the current 2FA code and a countdown to the next one. Check a code against the key, or create a new key and a QR code for your authenticator app.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsSecret key (Base32)
Current code
Enter a secret key and the code will show up here.
Verify a code
Window: ±1 step (up to 30 seconds before or after now)
Create a 2FA QR code
Issuer
Account name
Enter a valid secret key to see the QR code.
Scan it with an authenticator app such as Google Authenticator, Microsoft Authenticator, or Authy. Some apps support only the defaults (SHA-1, 6 digits, 30 seconds), so test other settings before relying on them.
For testing and debugging. For accounts that matter, use a dedicated authenticator app. The tool does not send or save your secret key.
What Is a TOTP Code and How Is It Made?
TOTP (Time-based One-Time Password) is the 6-digit code your authenticator app shows and refreshes every 30 seconds. It is calculated from a secret key and the current time, using the method defined in RFC 6238. The service stores the same key, so it can work out the same code without anything being sent to your phone.
This page does three things in one place: it generates the current code from a key, verifies a code you type in, and creates a new key with an otpauth QR code that authenticator apps can scan. You can also paste a full otpauth:// link, and the key and settings are filled in for you.
The calculation uses the Web Crypto API in your browser, and the tool does not send the key anywhere or store it. It reads your device's clock for the current time.
Where This Tool Helps: Testing, Debugging, Setup
Testing a 2FA login you are building
Enter the test account's secret key and compare the code shown here with what your server expects. If they differ, the problem is in your implementation, not the user's app.
Debugging an "invalid code" error
When an authenticator code is rejected, run it through Verify Code with a ±1 or ±2 window. A match at an offset points to clock drift, and no match points to the key or the settings.
Making a QR code for a test or staging app
Generate a random key, enter an issuer and account name, and scan the QR code with an authenticator app. You get a working 2FA setup without writing any code.
Checking that a saved setup key still works
Before you retire an old phone, paste the backup key you saved and compare the code with your app. If they match, the backup is good.
Get a Code From a Secret Key, Step by Step
- Paste your Base32 secret key (or an otpauth:// link) into the key field, or click Generate random key to make a new one.
- Open Settings only if your service uses something other than SHA-1, 6 digits, and a 30-second step.
- Read the current code and the countdown at the top. The previous and next codes are shown below it.
- To check a code from another app, type it into Verify Code, pick a window, and click Verify.
- To add the key to an authenticator app, fill in the issuer and account name, then scan the QR code.
Note: The key, the codes, and the QR code exist only in this page's memory while it is open.
Before You Paste a Secret Key
- This is a testing and debugging tool. It does not save keys or back them up, so it is not a replacement for an authenticator app or a hardware security key.
- A secret key works like a password. Anyone who has it can generate your codes, so be careful with screen sharing and screenshots.
- The tool uses your computer's clock. If your clock is off, the codes will be off too, no matter how the key is entered.
- Most services use SHA-1, 6 digits, and a 30-second step. Change the settings only when you know the service uses something else.
TOTP Settings: Defaults and Options
These are the settings this tool supports. The defaults follow RFC 6238 and are what most authenticator apps expect.
| Setting | Default | Other options here | Notes |
|---|---|---|---|
| Hash algorithm | SHA-1 | SHA-256, SHA-512 | RFC 6238 allows all three. Some authenticator apps support only SHA-1. |
| Code length | 6 digits | 8 digits | The HOTP spec (RFC 4226) allows 6 to 8 digits. |
| Time step | 30 seconds | 60 seconds | 30 seconds is the default in RFC 6238. |
| Secret key | Base32 text | Spaces and hyphens are ignored; lowercase is accepted | Only the letters A–Z and the digits 2–7 are valid. |
| Verification window | ±1 step | ±0, ±2 | Each step equals the time step, so ±1 at 30 seconds covers 30 seconds either side. |
If your service documents its own settings, follow those. When it says nothing, start with SHA-1, 6 digits, and 30 seconds.
How Time-Based Codes Work, and TOTP vs. SMS
A short look at the calculation, why the key must stay private, and how TOTP compares with other one-time codes.
How the code is calculated
The time is divided into steps of 30 seconds (the default), and the step number is the current Unix time divided by the step length, rounded down. That number is run through HMAC with your secret key, and the result is cut down to a 6-digit code. Because the service and your app share the key and both know the time, they get the same code without talking to each other.
Why the secret key must stay private
The secret key is the only thing needed to produce valid codes. Anyone who copies it can generate the same codes you do, and the service cannot tell the difference. That is why this tool runs in your browser and keeps the key in page memory only, and why you should treat the key like a password.
TOTP vs. SMS codes
An SMS code is generated by the service and sent over the phone network, so it can be intercepted or redirected, for example through SIM swapping. A TOTP code is calculated on your own device after the key is shared once, so there is no message to intercept. Services that offer both usually treat an authenticator app as the stronger choice.
TOTP vs. HOTP
HOTP (RFC 4226) uses a counter that goes up each time a code is used, while TOTP replaces the counter with the time step. A TOTP code expires on its own when the step ends. This tool handles TOTP only, so it cannot read otpauth:// links of the hotp type.
Common Mistakes When Testing 2FA Codes
Sharing a screenshot that shows the QR code or setup key
A 2FA setup screen, or a screen share where the QR code or key is visible, gives the viewer everything needed to generate your codes.
💡 See the solution▼
Running the check on a device with the wrong time
If your computer or phone clock is off by a minute or more, the codes will not match the service, even when the key and settings are right.
💡 See the solution▼
Mistyping the key (0 vs. O, 1 vs. I)
Base32 keys use the letters A–Z and the digits 2–7 only. A "0" or "1" in a key you typed by hand is almost certainly a letter O or I.
💡 See the solution▼
Leaving non-default settings turned on
You switch to SHA-256 or 8 digits for a test, forget to switch back, and then compare codes against a service that uses the defaults.
💡 See the solution▼
Not saving the setup key before switching phones
If you scan a QR code and keep no copy of the key, you can lose access to the account when the phone is replaced or reset.
💡 See the solution▼
Authenticator Code FAQ
Q.What is a TOTP code, and how is it different from an SMS code?
A. TOTP (Time-based One-Time Password, defined in RFC 6238) is a short code computed from a shared secret key and the current time. By default it changes every 30 seconds. Your authenticator app and the service each compute it on their own, so nothing has to be sent to your phone. An SMS code is created by the service and delivered over the phone network, where it can be intercepted or redirected, for example in a SIM swap.
Q.Is it safe to paste my secret key into this tool?
A. The code on this page calculates everything in your browser with the Web Crypto API and does not send the key anywhere or save it. Even so, a secret key works like a password: anyone who has it can generate your codes. For a real account, use a test account when you can, or reset the 2FA key after you finish testing.
Q.Where do I find the secret key for my account?
A. When you turn on two-factor authentication, many services show a QR code plus a text option such as "Can't scan the code?" or "Enter this setup key." That text is the Base32 secret key. If you have an otpauth:// link instead, paste the whole link into the key field and this tool fills in the key and settings for you.
Q.Why doesn't the code here match my authenticator app?
A. Check three things. First, the clock: this tool reads your computer's clock, and the service checks codes against its own, so a device that is off by a minute produces codes that fail. Turn on automatic date and time. Second, the settings: algorithm, digits, and time step must match the service. Third, the key: a single wrong character gives a completely different code. Then run Verify Code with a window of ±1 or ±2. If the code only matches at an offset, clock drift is the likely cause.
Q.What does the verification window (±0, ±1, ±2) mean?
A. Verify Code compares the code you enter with the code for the current time step and for N steps before and after it, where N is the window you pick. With the default 30-second step, ±1 accepts codes from the previous 30 seconds up to the next 30 seconds. RFC 6238 recommends allowing at most one step of delay, so ±1 is a reasonable setting for testing.
Q.When would I use SHA-256, SHA-512, 8 digits, or a 60-second step?
A. RFC 6238 allows SHA-256 and SHA-512 in place of SHA-1, and the underlying HOTP spec allows 6 to 8 digits. Most consumer services use SHA-1, 6 digits, and 30 seconds, and some authenticator apps support only those defaults. Change the settings only to test a system you are building or to match a service that tells you to.
Q.Can I use this as my everyday authenticator app?
A. It is not built for that. This tool keeps nothing between visits, so there is no saved key, no backup, and no device lock. Use a dedicated authenticator app, a password manager with TOTP support, or a hardware security key for accounts you care about, and use this page to test and debug.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.