Hashes/Crypto
TOTP Generator/Verifier
Time-based one-time passwords (TOTP, RFC 6238) — generate the current code from a secret and verify an entered code with clock-drift tolerance.
------
TOTP (Time-based One-Time Password, RFC 6238) is a two-factor authentication algorithm that generates a one-time code from a secret and the current time. It's exactly what runs under the hood in Google Authenticator, Authy, and similar apps.
How to use it
- Generate: paste a secret key (usually Base32, the same one encoded in a 2FA setup QR code) and the tool shows the current 6-digit code along with the time left before it changes.
- Verify: enter a secret and a code from an authenticator app to check whether they match.
- Verification tolerates a small amount of clock drift — it accepts a code from a neighboring time step, not just the current one.
Common uses
- Debugging your own 2FA implementation on the backend — checking that the server generates and accepts codes correctly.
- Manually generating a code for an account when you don't have your phone with the authenticator app handy.
- Figuring out why an app's code is being rejected by the server (usually the cause is a clock out of sync).
Things to keep in mind
A TOTP code is only valid for a short window (usually 30 seconds) — that time limit is the main protection, not the secret alone.
Code accuracy depends directly on the device's clock being synced; a noticeable clock drift is the most common cause of rejected 2FA codes.
Article about this tool: TOTP: how one-time codes in authenticator apps work
Frequently asked questions
Why does my generated code expire so quickly?
TOTP codes are time-based — by default they rotate every 30 seconds, calculated from the current Unix time and the shared secret. This short window limits how long a leaked code stays useful.
What happens if my device's clock is out of sync?
TOTP relies on both sides agreeing closely on the current time. Most authenticator apps and servers allow a small clock drift tolerance (typically one time step), but larger drift will cause valid codes to be rejected.
Is my secret key sent anywhere when generating a code here?
No. The TOTP code is computed entirely in your browser — the secret key never leaves your device.
Does TOTP protect against phishing?
Not entirely. If a victim enters their password and current TOTP code on a fake site, an attacker can instantly use both values on the real site while the code is still valid. Only hardware keys following the FIDO2/WebAuthn standard protect against this kind of real-time attack.
Why does the server also accept the previous time step, not just the current one?
This compensates for a small amount of network delay between generating the code on a phone and the server receiving and checking it. Without this tolerance, legitimate codes would occasionally be rejected due to an ordinary delay of a few seconds.