TOTP Code Generator

When a site asks for a six-digit code from an authenticator app, it is using TOTP, the time-based one-time password algorithm of RFC 6238. The app and the server share a secret key once, usually by scanning a QR code. After that each side computes the same code from that secret and the current time, so nothing needs to be sent. This page runs the algorithm, which makes it a handy way to test a setup, to see what a secret should produce, or to understand why a code was rejected.

The arithmetic

TOTP builds on HOTP (RFC 4226). First the time is turned into a counter: the number of whole periods, normally 30 seconds each, since 1 January 1970 UTC. That counter is written as eight bytes and run through HMAC with the shared secret, SHA-1 by default. The 20-byte result is shortened by taking four bytes at an offset taken from its last nibble, ignoring the top bit, and reducing the number modulo 10 to the power of the digit count. Leading zeros are kept, which is why a code can start with 0.

A worked setup

Press Sample. The secret is JBSWY3DPEHPK3PXP, a common test value in Base32, with issuer Example and account [email protected]. The page shows the current code in two groups of three digits, such as 853 145, with a bar counting down the seconds to the next code, and the settings it used: SHA-1, six digits, 30 seconds. It also builds the link otpauth://totp/Example:alice%40example.test?secret=JBSWY3DPEHPK3PXP&issuer=Example and a QR code for it. Scan that with an authenticator app and both should show the same number at the same moment.

The otpauth link

An otpauth URL carries everything an app needs: the type (totp), a label made of issuer and account, the secret and optional parameters for the issuer, algorithm, digits and period. When you paste a link copied from a QR code, the page reads those parameters instead of the defaults. You can also drop a screenshot or photo of a QR code onto the page and have it decoded on your device.

Why a code is rejected

The clock is the usual culprit. If a phone or computer is more than about half a minute off, its codes belong to a different period. Turn on automatic time. Next come settings: some apps silently ignore SHA-256, SHA-512, eight digits and 60-second periods and fall back to SHA-1, six digits and 30 seconds, so the code on the phone differs from the one on the server. Finally, check the secret itself: Base32 uses letters A to Z and digits 2 to 7, so a 0, 1, 8 or 9 means a typing error.

Limits

Treat a real TOTP secret like a password: whoever has it can generate your codes. The page calculates locally and stores nothing, but use test secrets, and keep real ones in an authenticator or a password manager. The page generates codes; it does not enrol you with any service.

Related tools

• HMAC Generator shows the keyed hash at the centre of the algorithm.
• QR Code Generator makes QR codes for other kinds of text.
• Base32 Encoder converts secrets between text and Base32.
• Password Generator covers the first factor.