— — — — — —
click to copy
Valid for
30s
Next code in
Whether you're building 2FA into your own app, debugging an authenticator integration, or just need to understand how a one-time password is computed, this tool lets you generate and verify OTP codes exactly the way a real authenticator app would — with nothing sent to a server.
From secret key to working code in four straightforward steps.
A little background on how one-time passwords actually work makes debugging 2FA issues far less mysterious.
TOTP (Time-based One-Time Password) is defined in RFC 6238 and is the algorithm behind almost every "authenticator app" code you've ever typed in. It takes a shared secret key and the current time, rounds the time down to the nearest step (usually 30 seconds), then runs both through an HMAC-SHA1 hash to produce a short numeric code. Because both your device and the server know the secret and the time, they can independently compute the same code without ever transmitting it.
HOTP (HMAC-based One-Time Password), defined in RFC 4226, is TOTP's predecessor. Instead of using the current time, it uses a counter that increments by one every time a new code is generated. This is why some hardware security tokens with a physical button use HOTP — pressing the button increments the counter and produces the next code, with no clock required. TOTP is simply HOTP with the counter replaced by "current time ÷ time step."
Because TOTP and HOTP codes are derived entirely from a secret key plus a counter or timestamp, generating or verifying a code requires nothing more than local math — an HMAC-SHA1 hash computed with JavaScript's Web Crypto capabilities. There's no reason to send your secret anywhere, which is exactly how this tool works: every code shown or checked here is computed on your device, in your browser tab, and discarded the moment you navigate away.
Quick guide to which mode fits the situation you're working with.
| Mode | Based On | Where it's Used |
|---|---|---|
| TOTP Popular | Current time | Google Authenticator, Authy, Microsoft Authenticator, most app-based 2FA |
| HOTP | Incrementing counter | Hardware tokens with a physical button, offline OTP devices, legacy 2FA systems |
| Verify Popular | Secret + submitted code | Debugging failed logins, testing a backend 2FA implementation, QA of login flows |
| 6-digit | Digit length setting | Default for nearly all consumer authenticator apps |
| 8-digit | Digit length setting | Some enterprise and banking systems that require longer codes |
| otpauth:// URI | Standard provisioning format | Scanning a new secret into an authenticator app via QR code |
Understanding and testing one-time passwords matters well beyond just logging in — this tool covers every common scenario.
Answers to the most common questions about generating and verifying OTP / TOTP codes with this tool.
Yes — completely free. There are no limits, no accounts, no watermarks, and no charges. Generate and verify as many codes as you need.
No — never. All OTP and TOTP computation happens locally in your browser using HMAC-SHA1. Your secret key never leaves your device.
TOTP generates a new code every fixed interval, typically 30 seconds, based on the current time. HOTP generates a code based on a counter that increments each time a code is requested, rather than the clock.
Yes. Enter or generate a Base32 secret, then use TOTP or HOTP mode to produce codes exactly as an authenticator app would, or use Verify mode to confirm a code matches a given secret and time window.
Yes. The tool generates a standard otpauth:// URI and a scannable QR code that works with Google Authenticator, Authy, Microsoft Authenticator, and any RFC 6238-compliant authenticator app.
The tool uses HMAC-SHA1 as specified in RFC 6238 and RFC 4226, the algorithm supported by virtually every authenticator app. You can choose 6 or 8 digit codes and adjust the time step to match your target system.
Tried the tool? Leave a quick rating and help others find it.
All tools at I7 Pixel run in your browser — no uploads, no accounts, always free.