So nutzt du: TOTP Generator
- Paste the secret key from your service’s 2FA setup (the text shown under “Can’t scan the QR code?”), or click New random secret.
- The current code appears with a countdown; it changes every 30 seconds, like in your authenticator app.
- For testing your own app: copy the otpauth:// link or make a QR code from it and scan it with an authenticator.
- Type a code into Check a code to see whether it is valid right now.
How TOTP works
A time-based one-time password (TOTP, RFC 6238) is an HMAC of the current 30-second time step, keyed with a shared secret. Your phone and the server both know the secret, so both compute the same 6 digits without talking to each other. The secret is shown once during setup — usually as a QR code containing an otpauth://totp/…?secret=… link — and stored by your authenticator app.
| Setting | Usual value | Note |
|---|---|---|
| Algorithm | SHA-1 | What Google Authenticator and almost every service use; SHA-256/512 are rarely supported by apps. |
| Digits | 6 | Some banks and Steam-style tokens use 8. |
| Period | 30 seconds | Codes are accepted for a step before and after, to allow clock drift. |
Codes don’t match?
- Clock: TOTP depends on the time. Turn on automatic date and time on your phone and computer.
- Secret: copy it exactly; it is Base32 (A–Z and 2–7) — 0, 1 and 8 never appear.
- Settings: digits, period and algorithm must match what the service uses (the otpauth link says so).
Security
Codes are calculated with your browser’s built-in Web Crypto — the secret is never sent anywhere. Even so, a 2FA secret is as sensitive as a password: use this tool for development and recovery checks, not on shared computers.
Related: Password Generator, HMAC Generator, QR Code Generator.
Auch gesucht als: 2fa code generator, totp code, authenticator code generator, google authenticator online, otp generator, otpauth uri, totp secret generator, verify totp.
Passende Tools zu: TOTP Generator
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- Password Breach Checker — Find out whether a password has appeared in known data breaches — billions of leaked passwords collected by Have I Been Pwned.
- JWT-Decoder — Füge ein JSON-Web-Token ein, um dessen Header und Payload zu überprüfen, das Ablaufdatum zu ermitteln und die Signatur zu verifizieren.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.