TOTP Authenticator
Generate, verify, inspect and analyze TOTP authentication codes entirely inside your browser.
⚙️ Configuration
🔑 Live Code
Enter a secret above and click "Apply Configuration" to generate codes.
✅ Verification
📱 QR Code
🔍 Secret Inspector
📋 Compatibility
🧪 Test Vectors
📖 How TOTP Works
What is TOTP?
TOTP (Time-based One-Time Password) is defined in RFC 6238. It generates a short numeric code that changes every 30 seconds (by default). It's used as a second factor in two-factor authentication (2FA).
How does it work?
1. A shared secret key is established between server and client.
2. The current time is divided by the period (default 30s) to get a counter value.
3. The counter is hashed using HMAC with the secret key (default SHA-1).
4. A dynamic truncation extracts a 6–8 digit code from the hash.
Formula: TOTP = Truncate(HMAC-SHA1(secret, floor(time / period)))
Why does it expire?
The code is tied to a specific time window. Once the window passes, the counter increments and a completely different code is generated. This limits the window of opportunity for an attacker.
What is the secret?
The secret is a cryptographic key (typically 20 bytes for SHA-1, 32 for SHA-256, 64 for SHA-512) encoded in Base32. It must remain confidential — anyone with the secret can generate valid codes.
What is Base32?
Base32 encodes binary data using 32 characters: A-Z and 2-7. It's used because these characters are unambiguous and easy to type. Padding (=) is optional in TOTP URIs.
HOTP vs TOTP
HOTP (RFC 4226) uses an incrementing counter instead of time. The code only changes when the counter advances. TOTP is essentially HOTP where the counter is floor(unix_time / period).