TOTP Generator: Live 2FA Codes and a Mismatch Finder
Live TOTP codes from a Base32 secret or an otpauth link, with a countdown ring, a QR code for your phone, and a checker that explains why a code was rejected.
- Free, no account
- No watermark
- No usage limit
About the TOTP Generator
The login screen says your code is wrong. You typed it carefully, you are looking right at it, and the server still will not take it. Most free TOTP tools answer that by printing you another code, which was never the problem.
So this one does the other half of the job. Paste the code that got rejected and it searches ten time steps either side of now, then works through every common digit count, hash and window length until it finds the combination that actually produces those digits. Then it tells you in plain words what broke: a clock two minutes slow, an eight digit SHA-256 setup on the other end, or nothing at all, which means the key in your box is not the key that code came from.
The generating half is quick and ordinary. Drop in a Base32 key, or paste the whole otpauth link and it pulls the issuer, digits, window and hash out of it for you. You get a live code with a countdown ring, plus the code before and the code after, the two a server with a one step window also accepts.
Your secret stays on this page. Nothing is uploaded, nothing survives the tab closing, and the share link carries your digits, window and hash and nothing else.
How to generate a code, and check one that failed
- Paste your secret into the top box. A raw Base32 key works, and so does a full otpauth link, which saves you picking the key out by hand.
- Read the code. It shows up straight away, and the ring counts down the seconds until it rolls over.
- Copy it with the button beside it. The row underneath holds the previous and next codes if you need one of those instead.
- Got a code that was rejected? Put those digits in the checker and press Check this code.
- If the checker finds a drift, the button next to the answer shifts this page to match the device that made the code, so you can carry on while you go and fix the clock properly.
Why a TOTP code gets rejected
A code comes from two ingredients: the shared secret, and the current time chopped into thirty second blocks. Both ends run the same sum, so the same secret in the same block gives the same six digits. Almost every failure comes down to one of two things.
The clock. If your machine and the server land in different blocks, you get different codes, and neither side can tell which one is off. Most servers accept one block either side, so in practice you have about a ninety second grace period, and past that everything is refused. The usual suspects are a laptop that slept through the weekend, a virtual machine that came back up on the wrong minute, and a phone with automatic time switched off. This is the failure that comes and goes, and that is the useful tell. Codes that work sometimes and fail other times, particularly near the end of a countdown, are almost always a clock.
The settings. RFC 6238 lets a service pick the code length, the window and the hash, and changing any one of them changes the digits completely. An eight digit code is not a six digit code with two extra numbers on the front, it is a different number. So a server issuing eight digit SHA-256 codes will never agree with an app assuming six digit SHA-1, and unlike drift it does not work even once. That is the quickest way to tell the two apart before you run anything.
The checker sorts out which one you have, reporting the gap in seconds when your settings are right and naming the digit count, hash and window when they are not.
When you want several accounts instead of one
This page is built around a single secret and the question why was this code refused. If what you actually want is every code at once, GitHub and the work email and the bank all ticking side by side, kept in one link you can bookmark, that is the 2FA Authenticator. The arithmetic underneath is the same, but the job is not: this one debugs a single code, and that one holds a set of them.
Putting the secret on your phone
Open the QR panel, add the service name and account label so they read nicely in the app, then scan. Any authenticator app takes the same link.
One honest warning. A browser tab is a good place to test a secret or debug an enrollment flow. It is a poor place to keep the 2FA secret for your own bank. For an account you sign into every day, use a real authenticator app or a hardware key.
Frequently asked questions
Is it safe to paste a real 2FA secret into a web page?
The sum happens in your browser and nothing is transmitted, so the secret does not travel. What is left is the machine you are sitting at. A shared or managed computer can carry a keylogger or a screen recorder, and neither cares that a tool is offline. On a borrowed machine, do not paste a key you cannot rotate afterwards. The Share button leaves the secret out too, so a link you send a colleague carries your settings and not your key.
What is the difference between TOTP and HOTP?
The difference is what drives the counter. TOTP uses the clock, so a code expires on a timer whether anyone touches it or not. HOTP uses a counter that only moves when a code gets spent, which is why the two ends slide apart if a user generates codes without submitting them. Time based codes avoided that by handing both ends a counter they already share. Paste a link starting with otpauth://hotp here and the tool says so rather than quietly giving you the wrong number.
My service showed a QR code but no secret. Where is the key?
Look for the small link under the square that says something like "can't scan the code" or "enter this key manually". That shows the same secret as text, usually in groups of four letters, and that string is what you paste here. If the page does not offer one, read the QR image with any QR reader to get the full otpauth link, which this tool accepts whole.
Can I use 8 digits or SHA-256?
Only if you own both ends. The otpauth link is closer to a suggestion than a contract, and Google Authenticator has long ignored the algorithm, digits and period values in one, producing six digit SHA-1 codes on a thirty second window whatever you put in there. Some apps respect those fields and some do not, and your users will have no idea which one they installed. Stay on the defaults unless you control the verifier and the app.
Does it matter if my secret has spaces or lowercase letters?
No. Base32 ignores case, and the spaces are only there so a human can read the key out loud, so both get stripped here. What does matter is the alphabet, because Base32 uses A to Z plus the digits 2 to 7 and nothing else. A 0, a 1 or an 8 in a secret is nearly always a mistyped O, I or B, and this tool names the character that broke rather than calling the whole secret invalid and leaving you to hunt.