Test your 2FA setup with a local TOTP generator

You're building OTP verification and the QR enrolment works — but does your backend accept the codes? Generate RFC 6238 codes locally to check.

Tools used in this guide

The job

TOTP enrolment gives you a base32 secret. To verify your server's acceptance path — or to recover a code when your phone isn't handy — you need the current 6-digit code for that secret.

Secret in, code out

Paste the base32 secret (the text under the QR code). The current code appears with a countdown to expiry; 6 digits and a 30-second step are the defaults every authenticator app uses, but 8-digit and custom steps are supported for odd issuers.

The secret never leaves the page — generation is in-browser HMAC-SHA-1.
Codes are time-based: if your server rejects correct-looking codes, check clock drift first.

Own accounts only

A TOTP secret is as good as the second factor itself — paste it nowhere you wouldn't paste a password, and only ever for accounts that are yours. This page is for development testing and your own recovery.