Tools Home|100% Client-Side

TOTP / 2FA Token Generator & Authenticator Debugger

Generate RFC 6238 time-based one-time passwords (TOTP), test 2FA secret keys, inspect otpauth:// URIs, and simulate token countdowns client-side.

RFC 6238 / RFC 4226 WebCrypto Sandbox
Current TOTP Dynamic Passcode
--- ---
Seconds until refresh:30s
Issuer (Service Name):
Account Name (Email/User):
Hash Algorithm:
Token Digits:
Time Step Period:
Standard otpauth:// URI

Scan or import this URI directly into Authenticator applications (Google Authenticator, Authy, Bitwarden, 1Password) to provision 2FA accounts.

100% Client-Side Cryptography

Your 2FA shared secrets and verification tokens are computed strictly within your browser using native SubtleCrypto HMAC-SHA algorithms.

Full RFC 6238 & 4226 Fidelity

Compatible with industry authenticators. Supports custom step intervals, 6-digit or 8-digit truncation, and SHA-1/256/512 digests.

Standard otpauth:// Schemes

Generates ready-to-use URI schemes formatted for immediate QR generation and provisioning across team password vaults and test environments.

Technical Reference & Architecture Guide

RFC 6238 TOTP & Two-Factor Authentication Guide — Reference Guide

Technical guide to HMAC-based and time-based one-time passwords, Base32 decoding, window tolerance, and otpauth:// URI formatting.

Key Parameters & Controls

secretstring (Base32)

Shared cryptographic secret key encoded in Base32 without padding.

periodnumber (default: 30)

Time step duration in seconds before code expiration.

digitsnumber (default: 6)

Length of generated numerical verification passcode (typically 6 or 8).

algorithmenum ('SHA-1' | 'SHA-256' | 'SHA-512')

Cryptographic hash function used in HMAC computation.

Pro Tips & Best Practices

Always strip spaces and dashes from Base32 keys before computing the HMAC digest.

Allow a ±1 time step tolerance (skew window) on server validation to accommodate minor client clock drifts.

Encode account labels and issuer names safely using URL percent-encoding inside the otpauth:// URI scheme.

Common Gotchas & Troubleshooting

Verify device system clock sync; even a 30-second time drift will cause code mismatch.

Ensure characters only include uppercase A-Z and digits 2-7. Letters like '0', '1', '8', and '9' are not valid Base32.

Frequently Asked Questions

Is my 2FA secret key exposed or stored?▼

Never. All HMAC-SHA calculations and countdown timers run entirely in your local browser sandbox.

What is an otpauth:// URI?▼

It is the standardized URI scheme scanned by mobile authenticator apps like Google Authenticator and 1Password.

Why does the code change every 30 seconds?▼

RFC 6238 computes time steps as floor(current_unix_timestamp / period), rotating the digest every 30 seconds.

Can I generate 8-digit codes or SHA-256 tokens?▼

Yes, you can configure both digit length (6 or 8) and hash algorithms (SHA-1, SHA-256, SHA-512).

Related Tools & Utilities

All Tools →
JWT Secret Checker & Weak Key Audit (HMAC-SHA256/384/512)security

Audit JWT tokens locally for known weak HMAC secret keys, brute-force dictionary vulnerabilities, and verify signatures against custom candidate secrets.

Open tool→
SSH Key Fingerprint Calculator & Randomart Visualizersecurity

Inspect OpenSSH public keys (RSA, Ed25519, ECDSA), compute SHA-256 and MD5 fingerprints, and generate authentic OpenSSH ASCII Randomart visual art.

Open tool→
Punycode & IDN Domain Converter (RFC 3492 & Spoofing Detector)security

Convert internationalized domain names (IDN) bidirectionally between Unicode and ASCII Punycode (xn--) with built-in homograph attack and script spoofing analysis.

Open tool→
JWT Token Decoder & Security Inspectorsecurity

Decode JSON Web Tokens, inspect header/payload claims, calculate expiration time and verify integrity locally.

Open tool→
Cryptographically Secure Password Generatorsecurity

Generate ultra-secure passwords using Web Crypto API with custom length, symbols, and memorability.

Open tool→
Multi-Algorithm Hash Generator (SHA-256, SHA-512, MD5)security

Compute instant cryptographic hashes entirely in browser with zero server transmission.

Open tool→