TOTP Code Generator and Tester
Enter the secret key for an account you manage and see the code that should be showing right now, the ones either side, and whether a code you typed fits.
Use this for accounts and systems you run yourself, such as testing a new sign-in setup. Anyone who has the secret key can make valid codes, so treat it like a password.
Worked examples
A published test vector
Secret 12345678901234567890 (as Base32 GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ), SHA-1, 6 digits, time 59 seconds after 1 January 1970
287082
These are the values in the test tables of RFC 4226 and RFC 6238. With 8 digits at the same time the code is 94287082.
About TOTP Code Generator and Tester
Two-step sign-in codes look like magic, but they come from a short sum. Your authenticator app and the website share a secret key. Every 30 seconds each of them combines that key with the current time to make a six digit code, and because they do the same sum they agree without any message passing between them. The method is called TOTP, short for time-based one-time password, and it is defined in RFC 6238, which builds on the counter based method in RFC 4226.
This page does that sum for you, which makes it useful when you build or support a sign-in system. Enter the secret in Base32, the form that apps show under the QR code, and you see the code for now with a countdown, plus the codes for the step before and the step after. Type a code from a device and the tool tells you whether it matches, and if it belongs to a different step it tells you how far that device's clock has drifted, which is the most common reason a correct looking code is refused.
How to use TOTP Code Generator and Tester
- Paste the secret key, or press Make a new key to create one for testing.
- Leave the hash, digits and seconds at their usual values unless the service tells you otherwise.
- Read the code shown for now, and the ones for the previous and next steps.
- Type a code from an app into Code to test to see whether it matches and how far out it is.
Common uses
- Testing the two-step sign-in you are adding to your own site
- Working out why a user's codes are always rejected
- Checking that a secret key was copied across correctly
- Creating a setup link to load a test account into an app
Frequently asked questions
Why does the code change every 30 seconds?
The code is made from the key and the number of 30 second steps since 1 January 1970. When the next step starts the number changes, and so does the code. Some systems use a different step length, which you can set in Seconds per code.
Why does a correct code get rejected?
Usually the clock on the phone or the server is out of time. Type the code into the tester. If it fits one step behind or ahead, the clocks differ by about that many steps. Many servers accept one step either side to allow for small drifts.
What are the hash and digits settings?
Almost every service uses SHA-1 with 6 digits and 30 seconds, and most apps only support that. The other options exist in the standard and are here so you can test systems that use them.
Is it a problem to enter a real secret key here?
Anyone who has a secret key can make valid codes for that account, so treat it like a password. Use this page for accounts you run and for test keys, keep real keys out of screenshots and shared notes, and make a new key if you think one has leaked.
What is the setup link for?
It is the otpauth address that apps read from a QR code. It holds the key, the issuer name, the account name and the settings. Turn it into a QR code with a QR code maker to load a test account into an app by scanning.