🔑 TOTP / 2FA Authenticator Code Tester

How to use

1. Click "Generate random secret" for a random Base32 string, or paste in your own secret.
2. Fill in the issuer and the user's account email to build the QR code URI.
3. Scan the on-screen QR code with Google Authenticator or any other authenticator app to add the account.
4. Watch the 6-digit code refresh every 30 seconds alongside the countdown bar.

FAQ

Can I get the code without adding it to a phone app?

Yes. As long as you enter a valid Base32 secret, the browser runs the standard HMAC-SHA-1 computation itself and displays the 30-second code live.

Why does the code match what my server generates?

TOTP derives the code from a shared secret plus the current UTC time, so any device with the same secret produces the same number. That's also why clock sync between devices matters so much.

Will authentication still work if my clock is a few seconds off from the server?

Yes — most TOTP implementations allow a small tolerance window, typically one step (±30 seconds) before or after, so minor clock drift is absorbed automatically. If the gap grows much larger than that, though, codes will keep failing, so it's best to keep automatic time sync enabled on your device.