How to use the totp code generator for testing
- Use this page for testing only. Do not type the secret key of a real account into any website.
- Press Use the test secret to load the example secret from the standard, or paste a base32 secret from an app you are building.
- Choose the number of digits, the seconds per code and the algorithm. Leave the Unix time empty to use the current time, or enter a time to get the code for that moment.
- Read the code, the countdown and the next code, and compare them with your own app.
How the code is made
A time-based one-time password (TOTP) is made from a secret key and the current time. The time is cut into steps of 30 seconds, and the step number is run through an HMAC with the secret. A few bytes of the result are turned into a number of 6 to 8 digits. An app on your phone and the server do the same calculation, so they agree without talking to each other.
The test secret from the standard is the ASCII text 12345678901234567890 written in base32. With 8 digits, SHA-1 and the time 59 seconds, the code is 94287082. At times 1111111109, 1111111111, 1234567890, 2000000000 and 20000000000 the codes are 07081804, 14050471, 89005924, 69279037 and 65353130.
Using the page safely
A secret key is the same as a password for the second step of a login. Anyone who has it can make valid codes. Do not paste the secret from a real account into a web page, including this one. Nothing here is saved, sent or put in a link, but a test tool is for test keys only.
Use it to check that your own login code matches the standard, or to see why two clocks give different codes. If codes from another app do not match, the usual cause is a clock that is off by more than the code period. Create strong passwords with the Password Generator, make checksums with the Hash Generator, encode text with the Base64 Encoder and Decoder, and test password hashing with the Bcrypt Hash Generator.
Settings and limits
Most authenticator apps use 6 digits, 30 seconds and SHA-1. Some use SHA-256 or other settings, which you can try here. SHA-512 is not offered. Base32 uses the letters A to Z and the digits 2 to 7, and spaces, hyphens and padding are ignored. A character outside the alphabet is reported.
The hash functions are written into the page, so no browser feature is needed beyond ordinary scripting. The countdown uses the real clock rather than counting ticks, so it stays right if the tab is in the background. The page does not store the secret, so reloading clears it.
Assumptions and limits
- The code follows RFC 6238 with HMAC-SHA-1 or HMAC-SHA-256 and a dynamic truncation of the result.
- The time is read from your device clock unless you enter a Unix time yourself.
- The secret is never stored, sent, shared in a link or kept after the page closes.
- This is a test aid. It is not an authenticator for real accounts.
Frequently asked questions
What is a TOTP code?
It is a short number that changes every 30 seconds, made from a secret key and the current time. It is used as a second step when you log in, in addition to your password.
Why does my code not match another app?
The most common cause is a clock that is off by more than the period. Another is a different setting such as digits, period or algorithm. Check that both use the same secret and the same settings.
Is it safe to enter my account secret here?
You should not. Treat the secret like a password and keep it out of web pages. This page is meant for test keys, such as the standard's example, and for checking code you are developing.
What is the Unix time box for?
It lets you compute the code for a fixed moment, which is how the standard's test values are checked. Leave it empty to use the current time and see the live countdown.