Two-step sign-in apps produce six-digit codes from a shared secret and the current time. This tool does the same calculation, following RFC 6238, from a Base32 secret. It shows the code, how long it remains valid and the neighbouring codes, which helps when testing a setup or working out a clock problem.
How to use it
- Enter the Base32 secret.
- Check the digits, period and algorithm match the service.
- Press Generate code.
- Enter the code before it expires.
When it helps
- Testing a two-step sign-in setup.
- Checking that a secret works.
- Learning how authenticator apps work.
- Debugging time-sync problems.
Good to know
- Don't paste real account secrets on a shared or untrusted computer.
- Codes depend on the right time, so check your device clock.
- A code is valid for a short window, usually 30 seconds.
How TOTP works
Time-based one-time passwords combine a shared secret and the current time. The time is divided into steps, usually 30 seconds, and the step number is processed with HMAC to produce a number, from which the last six digits are taken. The server does the same calculation and compares.
Because both sides compute independently, no code needs to be sent, and codes expire quickly.
Worked example: the RFC test
The standard test secret, the ASCII text 12345678901234567890 encoded as Base32, at Unix time 59 with 8 digits and SHA-1 gives 94287082. Enter it, set the time to 59 and the digits to 8, and check.
Matching the published vector shows the tool implements the standard correctly.
Troubleshooting codes
If codes are rejected, the most common cause is clock drift: your device clock is off by more than a step. Turn on automatic time. Next, check the digits, period and algorithm match the service's settings. Some services use SHA-256 or 8 digits.
Make sure you copied the whole secret, with no spaces lost or letters confused.
Security advice
Treat a TOTP secret like a password: anyone who has it can generate your codes. Store backups securely, and keep recovery codes somewhere safe. Prefer hardware keys or passkeys for the most important accounts, since TOTP codes can be phished.
Don't enter real secrets on computers you don't control.
Understanding the neighbouring codes
Servers usually accept the previous and next code as well as the current one, to allow for small clock differences and for slow typing. The tool shows those so you can see the window around now.
If the current code fails but the previous or next works, your clock is slightly off.
Backing up your secret
When you set up two-step sign-in, save the secret key or recovery codes somewhere safe, such as a password manager. If you lose your authenticator without a backup, you could be locked out.
Questions
What's a Base32 secret?
A string of letters A to Z and digits 2 to 7, shown when you set up two-step sign-in.
Why doesn't my code work?
The time may be off, or the digits, period or algorithm may differ.