TOTP / HOTP Code Generator (2FA)

Authenticator apps make their six-digit codes with two public algorithms: HOTP (RFC 4226), which counts up, and TOTP (RFC 6238), which uses the clock. This generator takes the same Base32 secret the app was given — or the otpauth:// link inside the QR code — and shows the current, previous and next codes, the seconds left and a table of nearby steps. Use it to test your own 2FA implementation, to check a code at a given time, or to see why a code is rejected.

How to use this tool

1. Paste the Base32 secret or the whole otpauth:// link.
2. Keep TOTP, SHA-1, 6 digits and 30 seconds unless the service says otherwise.
3. Leave the time blank for now, or enter a Unix time or ISO date to see the code for that moment.
4. For HOTP, choose the counter-based type and enter the counter.

Formula

HOTP(K, C) = Truncate(HMAC-SHA-1(K, C)) mod 10^d. TOTP uses C = floor((now − T0) / X) with T0 = 0 (1 January 1970) and X = 30 seconds.

Truncate takes the low 4 bits of the last HMAC byte as an offset, reads 4 bytes from there and clears the top bit, giving a 31-bit number; d is the number of digits. SHA-256 and SHA-512 replace HMAC-SHA-1 when the service asks for them. The counter C is written as 8 bytes, most significant first.

Example

RFC 6238 uses the ASCII secret "12345678901234567890" with SHA-1 and 8 digits. At Unix time 59 the step is T = 1 and the code is 94287082; at 1111111109 (18 March 2005, 01:58:29 UTC) T = 37037036 and the code is 07081804. The same secret written in Base32 is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, and as HOTP with counter 1 it gives 287082.