Free tool
TOTP generator and code checker
Make a secret and its QR code, scan it with Google Authenticator or any app, and compare the codes. Paste a code to see which 30-second step it matches. Nothing on this page is sent anywhere.
Secret and QR codeMake one, or paste a base32 secret you are testing with.
Codes nowSHA-1, 6 digits, 30 seconds: what every authenticator app makes.
Previous------
Current------
Next------
Check a codeType the code your app shows, or the one your server rejected.
For developers
Reading the result
- Matches the current step: the secret and the clocks agree. If your server still rejects it, compare the server's clock with this device's, and check that it does not refuse a code because the same step was already used.
- Matches the previous or next step: a clock is off by up to 30 seconds. Accept one step either side, as RFC 6238 recommends.
- Matches a step further away: a clock is minutes off. Fix NTP on the server or automatic time on the phone; do not widen the window that far.
- Matches nothing: the app and the server hold different secrets. Decode the secret as base32, keep codes as strings, and confirm enrolment with one code before turning two-step on.
The full list of causes, with a reference check in Node: why your server rejects correct authenticator codes. SignOps Authenticator runs enrolment, the QR code, the check, backup codes and the per-user lock for you; the setup guide shows the two calls.
Frequently asked questions
More questions? Email us and the answer goes on this page.
hello@signops.devIs the secret sent anywhere?
No. The secret, the QR code and every code are made in this page with the browser's Web Crypto API. Use it for testing; do not paste the secret of a real account you care about into any web page.
Why does my server say a correct code is invalid?
Check the time step it matches here. If the code matches the previous or next step, a clock is off by up to 30 seconds and your server should accept one step either side. If it matches nothing, the secret differs: usually it was decoded as text instead of base32, or the code lost a leading zero.
Which parameters do authenticator apps support?
Every app supports SHA-1, 6 digits and 30 seconds. Google Authenticator ignores algorithm, digits and period in the URI and always uses those defaults, so keep them unless you control the app.
What is the otpauth URI format?
otpauth://totp/Issuer:account?secret=BASE32&issuer=Issuer, optionally with algorithm, digits and period. The QR code is that string. The label and the issuer parameter are what the app shows next to the codes.How long should a TOTP secret be?
RFC 6238 recommends the length of the HMAC output: 20 bytes for SHA-1, which is 32 base32 characters. This page makes 20-byte secrets.
Authenticator codes without the edge cases.
SignOps checks TOTP codes with drift, single use, backup codes and a per-user lock. 10,000 checks a month free.