Most two-factor login codes are TOTP codes: six digits that change every 30 seconds, made from a shared secret and the current time. This tool makes the same codes in your browser. Paste the secret key (written in Base32, the letters A to Z and digits 2 to 7) or a whole otpauth:// link, and it shows the current code with a ring that counts down to the next one, plus the previous and next codes. It is meant for developers who are building or testing two-factor login, for checking that a secret was copied correctly, and for anyone who has a saved secret and needs one code.
How a code is made
The secret is turned into bytes. The number of whole periods since 1 January 1970 (UTC) becomes an 8-byte counter. An HMAC of the counter with the secret gives a 20-byte value for SHA-1 (32 for SHA-256, 64 for SHA-512). The last four bits pick an offset, four bytes from there are read as a number with the top bit cleared, and the remainder after dividing by one million (for six digits) is the code, padded with leading zeros. This is the dynamic truncation of RFC 4226, and RFC 6238 only changes the counter to a time step.
Here is a check you can reproduce. The RFC 6238 test secret is the text 12345678901234567890, which in Base32 is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ. At 59 seconds after the epoch the counter is 1, and with SHA-1 and eight digits the code is 94287082. With six digits it is the last six, 287082. At 1111111109 seconds the code is 07081804, with its leading zero. The tests of this tool run the full table of RFC 6238 for all three hashes.
Algorithm, digits, period and otpauth links
Services describe a secret with an otpauth link, which is what the QR code in the setup screen contains. It can carry an issuer, an account name, the algorithm (SHA1, SHA256 or SHA512), the digits (6 to 8) and the period in seconds. Some apps ignore these options and always use SHA-1, six digits and 30 seconds, so if a code from this tool disagrees with your app, try those defaults. To read the link from a QR image, use the QR code scanner and paste the result here. A link for counter-based codes (HOTP) is recognised and refused, because those codes depend on a counter that only the service knows.
Safety
A TOTP secret is as valuable as a password: whoever has it can produce your codes forever. Do not paste the secret of a real account, such as your bank or your main email, into any website, including this one. This page runs in your browser, does not send the secret anywhere, does not keep it in storage or in the address bar, and forgets it when you close the tab, but you cannot verify that from the outside. Use it for test accounts and development, and keep real secrets in an authenticator app or a password manager. The password generator and the text encryption tool are the right places for other secrets, and the JWT decoder helps with tokens.
When a code is rejected
The code depends on your device clock. If the clock is a minute off, the code belongs to a different step and the service refuses it. Turn on automatic time. The previous and next codes are shown so you can see whether the service is accepting a neighbouring step, which many do to allow for small differences. Also check the secret for a missed character: a wrong secret still gives codes, they are just not the right ones.
