What are TOTP codes?
When you turn on two-step verification and use an app like Google Authenticator or Microsoft Authenticator, the site shows a QR code containing a secret key. The app combines this key with the current time to generate a 6-digit code that changes every 30 seconds. The method is called TOTP, an open standard (RFC 6238), and this tool implements it exactly, inside your browser.
When is it useful?
- Developers and testers: test the two-step feature of your app without a phone.
- Learning how it works: watch the code change and see why your phone clock must be accurate.
- Checking a backup key: confirm that a saved backup key produces the same codes as your app.
How to use it
- Paste the secret key (letters and digits like
JBSWY3DPEHPK3PXP) or a fullotpauth://link. - Keep the defaults (6 digits, 30 seconds, SHA-1) — what most sites use.
- The current code appears with a countdown and the next code.
- For a quick try, click “Generate a new test key”.
Why does a site sometimes reject a correct code?
Most often, the device clock is more than 30 seconds off. Turn on automatic time on your device. Most sites also accept the previous and next code to absorb small drifts.
Important security warning
The secret key is the second factor: whoever has it can generate your codes. So:
- Don’t use this page as a permanent replacement for the authenticator app on your phone.
- Never send the key to anyone or paste it on unknown sites. Any message asking for your verification code or key is a scam.
- Store the recovery codes the site gives you in a safe place.
Everything is computed in your browser; the page never sends or stores the key. To learn more, read our guide to two-factor authentication.