Live authenticator codes from a secret, a QR code for your app, and a code tester
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.An authenticator code comes from a shared secret and the clock, which is why it changes every 30 seconds. Paste a secret to watch live codes, get a QR code to add it to your phone, or test a code you were given. The secret stays local.
Paste a Base32 secret or an otpauth:// link into the Secret box, or press New secret for a random one.
Set Algorithm, Digits and Period to match the service; most use SHA-1, 6 digits and 30 s.
Read the Current code beside the countdown ring, with the Previous and Next codes below it.
Type a code into Test a code, choose the Drift allowance, and read Valid or Not valid.
This TOTP generator shows the live one-time code for a secret, with a ring counting down to the next code and the previous and next codes beside it. It builds the otpauth link and QR code that Google Authenticator, Microsoft Authenticator, Authy and password managers scan, and it tests whether a code you type is valid right now.
Developers use it while building two-factor login: generate a secret, scan it into a phone, and check that the server accepts the same codes the page shows. Support teams use the tester to see whether a user's code is simply late, because a code from the previous window means the phone clock is behind. It also reads an otpauth link pasted from a password manager export.
Codes follow RFC 6238 with a 30 or 60 second period, 6 or 8 digits and SHA-1, SHA-256 or SHA-512. Most apps only support the default of SHA-1, six digits and 30 seconds, so change those only if your server expects it. The tester allows a chosen drift of zero, one or two steps either side and tells you which step matched.
Everything runs in your browser with the Web Crypto API and the page's own clock, so the codes are only as right as your device time. Secrets are never sent, logged or saved; only your period, digits and algorithm are remembered. The QR code is drawn on the page and not fetched from any service.
Treat a real account's secret like its password: anyone who has it can make valid codes. Use generated test secrets for development. Related tools: HMAC Generator, Password Generator.
Paste the Base32 secret, the string of letters A to Z and digits 2 to 7 a site shows under its QR code, into the Secret box. The current code appears straight away with a countdown. Spaces and lower case are fine. If you have an otpauth:// link instead, paste that and the settings are filled in from it.
The secret never leaves this page: codes are calculated in your browser and nothing is sent, logged or stored. Still, anyone with the secret can generate your codes, so only paste a real account's secret on a device you trust, and prefer generated test secrets while developing.
The most common cause is clock drift: codes depend on the time, so a phone or server a minute off produces codes the other side does not expect. Use the tester to see whether the code matches the previous or next window. Other causes are a mistyped secret or an algorithm, digit count or period that differs from the server.
Servers usually accept codes from one step before and after the current one, so a code typed a few seconds late or from a slightly wrong clock still works. The tester lets you allow 0, 1 or 2 steps either side and reports which step matched, which tells you roughly how far off the clock is.
Many do not. Google Authenticator historically ignored those settings and used SHA-1, six digits and 30 seconds regardless, which gives wrong codes. Microsoft Authenticator, Authy and most password managers vary. Use the defaults unless you control both sides, and scan the QR code here to check your app's codes match.
HOTP (RFC 4226) makes a new code each time a counter goes up, usually when a button is pressed. TOTP (RFC 6238) replaces the counter with the current time divided into 30 or 60 second steps, so codes expire on their own. Almost all authenticator apps use TOTP; this tool generates and tests TOTP only.
Still stuck? Ask about TOTP Generator and Tester and anybody who knows can answer. No account needed.
On the related tools: CSP Validator – Find typos, missing semicolons and invalid sources in a Content-Security-Policy · JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember.
In the collection Security Tools for Developers.