TOTP Code Generator

about this tool

What the six digits actually are

A TOTP code is an HMAC of the current time, cut down to six digits. Both sides hold the same secret, both work out how many thirty-second steps have passed since 1970, and both compute the same answer. Nothing is transmitted and there is no server to ask, which is why an authenticator app works on a plane.

That also explains the two ways it fails. If the clock on either side is badly wrong, the codes will not match, and if the secret was mistyped by one character, every code will be wrong with no clue as to why.

The window

A server does not usually accept only the current code. It checks the step either side as well, which allows for a slow typist and for clocks a little out of step. This tool shows the previous and next codes for that reason, and tells you which step a code you check came from.

Accepting a wider window is a real tradeoff: it makes life easier for users and gives an attacker who has intercepted a code slightly longer to use it. One step either side is the usual compromise.

Checked against the specification

The digits come from a defined procedure, not a hash truncated by hand: RFC 4226 picks four bytes from the HMAC using the low nibble of its last byte, clears the top bit so the number is positive, and takes the remainder. Get any part of that wrong and you get plausible-looking codes that no server accepts.

Every published test vector from RFC 6238 is in this tool's test suite, for all three hash functions and at all six times, including the ones past 2038 that catch a 32-bit counter.

Use it to understand, not to store

This is a good way to check a secret works, to see what a setup link contains, or to test a login flow. It is not a place to keep the secret for an account you care about. Anything typed here lives in a browser tab; a real second factor belongs in an authenticator app or a hardware key, where the secret cannot be read back out.