TOTP Code Generator

about this tool

What the six digits actually are

A TOTP code is an HMAC of the current time, cut down to six digits. Both sides hold the same secret, both work out how many thirty-second steps have passed since 1970, and both compute the same answer. Nothing is transmitted and there is no server to ask, which is why an authenticator app works on a plane.

That also explains the two ways it fails. If the clock on either side is badly wrong, the codes will not match, and if the secret was mistyped by one character, every code will be wrong with no clue as to why.

The window

A server does not usually accept only the current code. It checks the step either side as well, which allows for a slow typist and for clocks a little out of step. This tool shows the previous and next codes for that reason, and tells you which step a code you check came from.

Accepting a wider window is a real tradeoff: it makes life easier for users and gives an attacker who has intercepted a code slightly longer to use it. One step either side is the usual compromise.

Checked against the specification

The digits come from a defined procedure, not a hash truncated by hand: RFC 4226 picks four bytes from the HMAC using the low nibble of its last byte, clears the top bit so the number is positive, and takes the remainder. Get any part of that wrong and you get plausible-looking codes that no server accepts.

Every published test vector from RFC 6238 is in this tool's test suite, for all three hash functions and at all six times, including the ones past 2038 that catch a 32-bit counter.

Use it to understand, not to store

This is a good way to check a secret works, to see what a setup link contains, or to test a login flow. It is not a place to keep the secret for an account you care about. Anything typed here lives in a browser tab; a real second factor belongs in an authenticator app or a hardware key, where the secret cannot be read back out.

The code is HMAC underneath, which the HMAC generator exposes directly. To turn an otpauth:// URI into the square an app scans, use the QR code generator.

questions

What is TOTP and where do the codes come from?

It is the standard behind authenticator apps: a shared secret plus the current time, hashed together, gives a six-digit code that changes every 30 seconds. No network is involved, which is why an authenticator works in aeroplane mode.

Why does my code not match my authenticator app?

Almost always the settings. Most apps assume six digits, a 30-second period and SHA-1; a service using eight digits, 60 seconds or SHA-256 needs those set here to match. Failing that, check that your clock is correct, since the code is derived from the time.

Why is SHA-1 the default when it is a broken hash?

Because HMAC-SHA1 is not affected by the collision attacks that broke SHA-1 for signatures, and essentially every authenticator app and service expects it. Changing it here only helps if the service on the other side also uses something else.

Can I use this instead of an authenticator app?

For testing an integration, yes. As your everyday second factor, no: pasting your TOTP secret into a browser tab and keeping it there defeats the purpose of a second factor, which is meant to live somewhere separate from the device you log in from.

Why does a code sometimes work just after it changes?

Because services usually accept the adjacent time window as well, to allow for a slightly wrong clock. Verification here does the same, so a code from the previous period is reported as valid rather than rejected outright.