Settings

Mode

Generate TOTP Generate HOTP Validate code

Secret key (Base32)

The shared secret from your authenticator setup, in Base32 format.

Digits

Algorithm

Time step (seconds)

Result

Everything runs locally in your browser. Your secret and codes are never sent to a server.

Common ways to use the OTP Code Generator and Validator:

Set up two-factor authentication
Generate the current TOTP code for an account after scanning the QR code, so you can finish signing in.
Verify a code you received
Check whether a one-time code from an email or SMS is still valid before entering it on a site.
Test your authenticator app
Compare the codes your authenticator produces against this tool to confirm the secret was entered correctly.
Debug HOTP integrations
Reproduce counter-based codes during development to verify your server-side validation logic.
Recover access without the app
If you have the Base32 secret, generate a fresh code on any device to regain access to your account.

What is the difference between TOTP and HOTP?: TOTP is time-based: the code changes automatically every time step (usually 30 seconds). HOTP is counter-based: the code changes each time the counter increments. Both are built on the same HMAC algorithm.
Where do I get the Base32 secret?: The secret is shown when you set up two-factor authentication, usually as a QR code or a string of characters. It is the same value your authenticator app uses.
Is my secret safe?: Yes. All processing happens locally in your browser using the WebCrypto API. Your secret and codes are never sent to any server.
Why is my code marked as invalid?: TOTP codes are only valid for a short window. If your device clock is out of sync, or the code is older than one time step, it will be marked invalid. Check the time and try again.
Which algorithms are supported?: SHA-1, SHA-256, and SHA-512. SHA-1 is the most common default for authenticator apps; choose the one your service uses.