TOTP Generator & Validator
Generate a TOTP secret, watch the rolling 6-digit code with a countdown ring, scan it into your authenticator app, and validate codes back.
RFC 6238Live codeQR enrollmentBuilt-in validator
Digits
Period
Algo
otpauth://totp/FileFactory%3Auser%40example.com?secret=XRBTKTNAEUNMDVKAODSJI7AIGDNO6JX6&issuer=FileFactoryCurrent code
Refreshes in 30s
Validate a code
Paste a code from an authenticator app to confirm this secret is set up correctly. A ±1 window is allowed for clock skew.
How to use
- Generate or paste a secret. A new base32 secret is created automatically; replace it with your own if you have one.
- Set label and issuer. These show up in your authenticator app entry.
- Scan the QR or copy the URI. Add the entry to Google Authenticator, 1Password, Authy, or any compatible app.
- Validate a code. Paste a code from your app to confirm the secret round-trips correctly.
Common use cases
- Adding TOTP-based 2FA to an app you build
- Recovering an authenticator entry from a saved secret
- Testing what code an authenticator should display right now
- Verifying digits/period/algorithm settings against a system
Frequently asked questions
- What is this tool best for?
- It is primarily useful for developers building TOTP-based 2FA into an application: you can generate a test secret, confirm the QR code round-trips correctly into an authenticator app, and validate live codes against a known secret. It is also handy for recovering access to an account when you have the raw secret saved but no longer have a working authenticator app.
- Will the codes match Google Authenticator and Authy?
- Yes, as long as the same base32 secret is used. The tool implements RFC 6238 (TOTP) and RFC 4226 (HOTP) with the standard defaults: SHA-1 algorithm, 6-digit codes, and a 30-second time step. These are the same defaults used by Google Authenticator, Authy, 1Password, and most TOTP-compatible apps.
- Does this tool send my secret to a server?
- No. All code generation runs in the browser. Your TOTP secret is never transmitted anywhere.
- How long is each code valid?
- Each 6-digit code is valid for one 30-second window. Most server implementations allow a tolerance of plus or minus one window (so up to 90 seconds total) to account for clock drift between client and server. After that window closes, the code is permanently invalid.
- What happens if someone gets my TOTP secret?
- They can generate valid codes indefinitely, the same as if they had your authenticator app. The secret must be kept private. If you believe it has been compromised, regenerate it on the service and re-enrol your authenticator app with the new secret immediately.
Related tools
How to use
- Generate or paste a secret. A new base32 secret is created automatically; replace it with your own if you have one.
- Set label and issuer. These show up in your authenticator app entry.
- Scan the QR or copy the URI. Add the entry to Google Authenticator, 1Password, Authy, or any compatible app.
- Validate a code. Paste a code from your app to confirm the secret round-trips correctly.
Common use cases
- Adding TOTP-based 2FA to an app you build
- Recovering an authenticator entry from a saved secret
- Testing what code an authenticator should display right now
- Verifying digits/period/algorithm settings against a system
Frequently asked questions
- What is this tool best for?
- It is primarily useful for developers building TOTP-based 2FA into an application: you can generate a test secret, confirm the QR code round-trips correctly into an authenticator app, and validate live codes against a known secret. It is also handy for recovering access to an account when you have the raw secret saved but no longer have a working authenticator app.
- Will the codes match Google Authenticator and Authy?
- Yes, as long as the same base32 secret is used. The tool implements RFC 6238 (TOTP) and RFC 4226 (HOTP) with the standard defaults: SHA-1 algorithm, 6-digit codes, and a 30-second time step. These are the same defaults used by Google Authenticator, Authy, 1Password, and most TOTP-compatible apps.
- Does this tool send my secret to a server?
- No. All code generation runs in the browser. Your TOTP secret is never transmitted anywhere.
- How long is each code valid?
- Each 6-digit code is valid for one 30-second window. Most server implementations allow a tolerance of plus or minus one window (so up to 90 seconds total) to account for clock drift between client and server. After that window closes, the code is permanently invalid.
- What happens if someone gets my TOTP secret?
- They can generate valid codes indefinitely, the same as if they had your authenticator app. The secret must be kept private. If you believe it has been compromised, regenerate it on the service and re-enrol your authenticator app with the new secret immediately.