Why doesn’t my code match the authenticator app?

Usually it’s the clock. TOTP divides the current time by the period (normally 30 seconds) to get a counter, so a clock that’s off by more than one period produces a different code — compare with the previous / next codes to see which way it’s off. Then check the algorithm and digits: many apps only support SHA-1, 6 digits and 30 seconds and silently ignore other settings.

What does an otpauth:// URI look like?

The standard form is otpauth://totp/Issuer:account?secret=BASE32SECRET&issuer=Issuer&algorithm=SHA1&digits=6&period=30. Only secret is required; the rest default to SHA1, 6 digits and 30 seconds. For HOTP replace totp with hotp and use a counter parameter instead of period. That’s the URI this tool builds, and it’s exactly what the QR code contains.

How large should the server’s tolerance window be?

±1 step (30 seconds either way) is usually enough to absorb clock drift and typing time, and RFC 6238 recommends allowing no more than one step of network delay. A larger window makes guessing easier. Also remember which time steps were already used so the same code can’t be replayed while it’s still valid.

Is it safe to paste a secret here?

Everything is computed in your browser; the secret is never sent anywhere or written to storage, and it’s gone when you close the page. But a TOTP secret is effectively a second password — anyone who sees your screen, a screenshot or your clipboard can generate codes — so avoid real production secrets on shared computers and test with a freshly generated one.

🗝️

🗝️TOTP Generator - 2FA Code Tester, otpauth URI and QR Code

When you build two-factor authentication you need a code generator to check against. Paste a Base32 secret, or a whole otpauth://totp/… URI (the issuer, account, algorithm, digits and period are read automatically), and you’ll see the current code with a countdown ring plus the previous and next codes — handy for spotting clock drift between a server and a phone. SHA-1, SHA-256 and SHA-512, 6 to 8 digits and any period are supported, as is counter-based HOTP. To enroll a new account, generate a random secret and get a standard otpauth:// URI and QR code that Google Authenticator, Microsoft Authenticator, 1Password and similar apps can scan. You can also verify a code within a ±N step tolerance window and see which step it matched. HMACs are computed with the browser’s WebCrypto and pass every RFC 6238 and RFC 4226 test vector; “Use a fixed time” reproduces the RFC examples. The secret lives only in this page’s memory and is never uploaded or stored — still, don’t paste real production secrets on a shared computer.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use TOTP Generator

1Paste a Base32 secret or otpauth:// URI, or click “Generate random secret”
2Adjust algorithm, digits and period, and read the current, previous and next codes
3Copy the otpauth URI or scan the QR code, and test codes in “Verify a code”

FAQ

Why doesn’t my code match the authenticator app?: Usually it’s the clock. TOTP divides the current time by the period (normally 30 seconds) to get a counter, so a clock that’s off by more than one period produces a different code — compare with the previous / next codes to see which way it’s off. Then check the algorithm and digits: many apps only support SHA-1, 6 digits and 30 seconds and silently ignore other settings.
What does an otpauth:// URI look like?: The standard form is otpauth://totp/Issuer:account?secret=BASE32SECRET&issuer=Issuer&algorithm=SHA1&digits=6&period=30. Only secret is required; the rest default to SHA1, 6 digits and 30 seconds. For HOTP replace totp with hotp and use a counter parameter instead of period. That’s the URI this tool builds, and it’s exactly what the QR code contains.
How large should the server’s tolerance window be?: ±1 step (30 seconds either way) is usually enough to absorb clock drift and typing time, and RFC 6238 recommends allowing no more than one step of network delay. A larger window makes guessing easier. Also remember which time steps were already used so the same code can’t be replayed while it’s still valid.
Is it safe to paste a secret here?: Everything is computed in your browser; the secret is never sent anywhere or written to storage, and it’s gone when you close the page. But a TOTP secret is effectively a second password — anyone who sees your screen, a screenshot or your clipboard can generate codes — so avoid real production secrets on shared computers and test with a freshly generated one.