What this tool does
- Generates 30-second rotating codes compliant with TOTP (RFC 6238) using your secret key.
- Works in the browser. No account, no installation.
- Useful for testing 2FA flows, backup access, staging environments, and developer demos.
How TOTP works (quick)
TOTP combines a shared secret (base32
) and the current time to compute a 6-digit code. The server and your authenticator both compute the code; a match proves possession of the secret and the correct time window.
How to use the online authenticator
- Get your secretfrom the service you’re enabling 2FA on (QR or base32 string like
JBSWY3DPEHPK3PXP
). - Enter the base32 secretin the tool or paste the
otpauth://
URI. - Optionally setissuer,account name, digits, and time step (default: 6 digits, 30 s).
- Copy the current code and complete verification on the target service.
Why use this vs. a mobile app?
- Speed: instant codes in any desktop browser for QA and CI checks.
- Visibility: inspect parameters, test drift, and edge-case windows.
- Portability: no device pairing required for temporary environments.
Security notes
- Protect your secret. Anyone with the base32 key can generate valid codes.
- Use HTTPS onlyand keep the page private. Clear the secret after use.
- Time accuracy matters. Ensure your device clock is synced (NTP). Even small drift can invalidate codes.
- Backup: store recovery codes from the destination service. The tool cannot recover lost secrets.
Compatibility
Supports standard TOTP used by Google, Microsoft, GitHub, AWS, Cloudflare, Slack, GitLab, and most OAuth/OpenID providers. HOTP (counter-based) is not supported unless specified by the service.
Common parameters
Field | Default | Notes |
---|---|---|
Digits | 6 | Some services allow 8. |
Period | 30 s | 60 s exists but is rare. |
Algorithm | SHA-1 | SHA-256/512 supported by some IdPs. |
URI | otpauth://totp/Issuer:Account?secret=...&issuer=...&period=30&digits=6 | Paste this to auto-fill. |
Developer tips
- Verify server and client periods match. Allow ±1 window to tolerate clock skew.
- Base32 secrets should be uppercase without spaces. Strip
=
padding if present. - When testing QR, decode to the
otpauth://
URI to confirm parameters.
FAQ
- Is this a replacement for Google Authenticator/Authy?
- No. It is a lightweight, browser-based generator for quick use and testing.
- Do you store my secrets?
- No. Code generation runs locally in your browser. Clear the page to remove inputs.
- Why do my codes fail?
- Check the secret, digits, algorithm, and system time. Ensure no trailing spaces and correct base32.
- Can I generate multiple tokens?
- Yes. Open multiple instances or profiles, each with a different secret.