2FA code generator and TOTP tester

How to use the generator

1. Paste the Base32 secret from your app or server into Secret key, or keep the random one to experiment.
2. Match Algorithm, Digits and Period to your configuration. Most services use SHA-1, 6 digits and 30 seconds.
3. Read the Current code. It changes when the bar runs out.
4. To debug a rejected code, type it into Check a code. The tool tells you whether it matches now, one step before or one step after.
5. To test an enrolment flow, fill in Issuer and Account and scan the QR code with an authenticator app.

How TOTP codes work

A time-based one-time password (TOTP, defined in RFC 6238) is calculated from two things: a secret shared once between the server and the user's app, and the current time.

1. The time is divided into steps, usually 30 seconds long, and the number of the current step is taken.
2. The step number is signed with the secret using HMAC, with SHA-1 by default.
3. Four bytes of the result are turned into a number, and the last 6 or 8 digits are the code.

The server does the same calculation and compares. Nothing is sent between the two, which is why authenticator apps work offline.

Why a correct code gets rejected

• Clock drift. If the phone or the server clock is off by more than a step, the codes disagree. Most servers accept one step either side, so a code from the previous or next step still works. The checker shows which step a code belongs to.
• Wrong settings. A secret enrolled with SHA-256 or 8 digits produces different codes than the defaults. Some apps ignore those settings in the QR code and always use SHA-1 and 6 digits.
• The secret was decoded twice or not at all. The secret in the QR code is Base32. Your server should store the decoded bytes, or the same Base32 string, and decode it exactly once.
• A reused code. Good servers reject a code that was already used, even within its 30 seconds.