# 2FA code generator and TOTP tester

> Paste a secret key to see its current two-factor code, check a code your server rejected, or create a test secret with a QR code for your authenticator app.

Source: https://getoxtro.com/2fa

This is an interactive tool. Use it at https://getoxtro.com/2fa; it runs in the browser.

## How to use the generator

1. Paste the Base32 secret from your app or server into **Secret key**, or keep the random one to experiment.
2. Match **Algorithm**, **Digits** and **Period** to your configuration. Most services use SHA-1, 6 digits and 30 seconds.
3. Read the **Current code**. It changes when the bar runs out.
4. To debug a rejected code, type it into **Check a code**. The tool tells you whether it matches now, one step before or one step after.
5. To test an enrolment flow, fill in **Issuer** and **Account** and scan the QR code with an authenticator app.

## How TOTP codes work

A time-based one-time password (TOTP, defined in RFC 6238) is calculated from two things: a secret shared once between the server and the user's app, and the current time.

1. The time is divided into steps, usually 30 seconds long, and the number of the current step is taken.
2. The step number is signed with the secret using HMAC, with SHA-1 by default.
3. Four bytes of the result are turned into a number, and the last 6 or 8 digits are the code.

The server does the same calculation and compares. Nothing is sent between the two, which is why authenticator apps work offline.

## Why a correct code gets rejected

- **Clock drift.** If the phone or the server clock is off by more than a step, the codes disagree. Most servers accept one step either side, so a code from the previous or next step still works. The checker shows which step a code belongs to.
- **Wrong settings.** A secret enrolled with SHA-256 or 8 digits produces different codes than the defaults. Some apps ignore those settings in the QR code and always use SHA-1 and 6 digits.
- **The secret was decoded twice or not at all.** The secret in the QR code is Base32. Your server should store the decoded bytes, or the same Base32 string, and decode it exactly once.
- **A reused code.** Good servers reject a code that was already used, even within its 30 seconds.

## Frequently asked questions

### Is it safe to paste my secret here?

The code is calculated in your browser with the Web Crypto API, and the secret is never sent anywhere. Still, a 2FA secret is as sensitive as a password. Use this tool with test secrets, and do not paste the secret of an account you care about into any website.

### Which authenticator apps work with these QR codes?

Any app that supports standard TOTP `otpauth://` links, including Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden and Authy. Some apps support only SHA-1 and 6 digits.

### What is the difference between TOTP and HOTP?

HOTP (RFC 4226) uses a counter that goes up each time a code is used. TOTP uses the current time instead, so codes expire on their own. TOTP is what almost every authenticator app uses.

### Should I use TOTP or SMS codes for two-factor authentication?

TOTP is stronger: nothing is sent over the phone network, so it is not exposed to SIM swapping or SMS interception. Phone codes are still useful to verify a phone number at sign-up. Our guide to [SMS, authenticator apps and WhatsApp codes](https://getoxtro.com/blog/comparing-sms-vs-app-based-two-factor-authentication-services) compares them.