TOTP Code Generator
Turns a TOTP secret into the current six-digit code with a countdown, for testing 2FA setups.
When you scan a 2FA QR code you are storing a shared secret, and there is no way to see from the app whether it was stored correctly until the next time you need to log in. Pasting the same secret here shows the code it should be producing right now, so a mismatch is visible before you are locked out.
The secret is held in this page’s memory and nowhere else. It is not written to localStorage, not put in the URL, and not sent to any server — the HMAC runs in your browser through crypto.subtle. Reloading the tab loses it, which is deliberate: this is a tool for checking a setup, not a replacement for an authenticator app that can keep the secret encrypted at rest.
How to use it
Paste the Base32 secret
This is the string a site shows under “can’t scan the code?”. Spaces and lower case are accepted; an `otpauth://` URI is accepted whole and its parameters read from it.
Match the parameters
Almost everything uses SHA-1, six digits and a 30-second period, which is the default here. A few services use eight digits or SHA-256 — if the code is wrong and the clock is right, this is where the difference is.
Compare against the app
Both should show the same six digits within the same window. If they differ by a whole window, the device clock is out — TOTP is a function of the current time, not of a counter.
Common questions
Is it safe to paste a live 2FA secret here?
The secret stays in the tab — the code is computed with the browser’s own HMAC and there is no request. But the secret alone is the whole second factor, so do not paste one into a page you have not checked, and clear the field when you are done.
Can this replace my authenticator app?
No — it stores nothing, so you would be pasting the secret again every login, and keeping a 2FA secret where you keep the password defeats the point of having two factors.
The code is rejected even though it matches the app.
Then both are wrong together, which almost always means the device clock is off. Servers usually accept one window either side; beyond that, sync the clock and try again.
Feed it from
OTP QR Builder
Builds an otpauth:// URI from issuer, account and secret and renders the QR an authenticator app can scan.
Authenticator Export Reader
Decodes a Google Authenticator migration QR into the individual accounts and their secrets.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
Next
These accept what this tool produces, so the result can go straight in.
HMAC Generator
Computes an HMAC over a message with a chosen hash and key encoding, for webhook signature checks.
Authenticator Export Reader
Decodes a Google Authenticator migration QR into the individual accounts and their secrets.
OTP QR Builder
Builds an otpauth:// URI from issuer, account and secret and renders the QR an authenticator app can scan.
QR & Barcode Reader
Reads QR codes and common barcodes from an uploaded image, a screenshot or the camera.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.