TOTP Generator
For debugging an enrolment that is not working. If the code here matches the authenticator app but the server rejects it, the problem is clock skew, not the secret.
Runs in your browser
Security & crypto
The value behind the QR code — otpauth:// URIs are accepted too and the
secret is extracted from them.
Previous window
Next window
This is a debugging tool, not an authenticator.
Everything runs in your browser and nothing is stored or transmitted — but pasting a live secret into any
web page defeats the second factor, because the secret is the factor. Use it against a test enrolment, or
one you are about to rotate.
Reading the result
- The code here matches the app, but the server rejects it
-
Clock skew on the server. TOTP is a function of the current time divided by the period, so a
server more than one window out computes a different counter. Check
timedatectlorchronyc trackingbefore touching anything else. Most implementations accept ±1 window; beyond that you need NTP, not a bigger tolerance. - The code here does not match the app
-
Wrong secret, or wrong parameters. Authenticator apps assume SHA-1, six digits, and a
30-second period regardless of what the enrolment URI says — several ignore the
algorithmparameter entirely. If your server issues SHA-256 secrets, that mismatch is the bug. - Base32, not Base64
- TOTP secrets are RFC 4648 Base32: A–Z and 2–7, no lowercase and no digits 0, 1, or 8. If your secret contains those characters it is not Base32 and something has already gone wrong.
- Codes must be single-use
- A valid code stays valid for the whole window. If the server does not record which counter a user has already spent, an intercepted code can be replayed for up to 30 seconds.