What is TOTP?
TOTP (Time-based One-Time Password, defined in RFC 6238) is the algorithm behind the 6-digit codes generated by Google Authenticator, Authy, Microsoft Authenticator, and similar 2FA apps. A TOTP code is generated from two inputs: a shared secret key (established during 2FA setup) and the current time (rounded to 30-second windows). Both the authenticator app and the server independently compute the same code from these inputs — no communication is required at code-generation time.
How TOTP codes are generated
The algorithm works in three steps. First, the current Unix time (seconds since January 1, 1970) is divided by the time period (30 seconds by default) and rounded down to give a time counter T. Second, an HMAC-SHA1 is computed using the secret key and T encoded as an 8-byte big-endian integer. Third, a dynamic truncation extracts a 31-bit number from the 20-byte HMAC output using the last nibble as an offset, then takes that number modulo 10^6 (for 6-digit codes) and zero-pads to 6 digits. This is the TOTP code.
The secret key
The secret key is established once during 2FA setup — typically as a QR code that also encodes the key as a Base32 string. Base32 uses the characters A–Z and 2–7 (32 characters total, chosen to be case-insensitive and avoid confusable characters). A standard TOTP secret is 160 bits (20 bytes), encoded as a 32-character Base32 string. The demo default key "JBSWY3DPEHPK3PXP" is a well-known test key used in TOTP documentation.
Who this tool is for
This tool is specifically for developers testing 2FA implementations. Use cases: verifying that your server correctly validates TOTP codes during development without needing a physical phone, generating test codes for automated test suites that need to authenticate with 2FA-protected accounts, debugging TOTP validation issues by comparing the code your server expects with the code the algorithm produces, and testing different time periods and digit counts supported by your implementation.
The 30-second window and clock synchronisation
TOTP codes are valid for exactly one 30-second window. Most implementations also accept the previous and next window (a ±30 second tolerance) to account for clock drift between the user's device and the server. The progress bar in the tool shows exactly how much of the current window has elapsed, giving you time to copy the code before it expires. The upcoming codes section shows the next two codes so you are never caught mid-rotation.
Security properties
TOTP codes are secure because the secret key is never transmitted after initial setup, codes change every 30 seconds making captured codes useless, and the HMAC-SHA1 computation is a one-way function — the secret cannot be derived from the codes. The main vulnerability is phishing attacks that relay codes in real time, which is why hardware security keys (FIDO2/WebAuthn) provide stronger protection than TOTP for high-value accounts.