Use a dedicated test secret for each environment
Generate a random test secret for each environment (development, staging, production). Never use your personal 2FA secrets for testing. The "Random key" button generates a cryptographically random Base32 secret each time — copy it into your test environment's configuration and use the tool to generate codes for that environment. Document the test secret in your team's secrets management system.
Automate TOTP in test suites
For automated end-to-end tests that need to log in to accounts protected by 2FA, implement TOTP code generation directly in your test code. In JavaScript: use the 'otplib' npm package. In Python: use 'pyotp'. In Ruby: use 'rotp'. All implement RFC 6238 and produce the same codes as this tool for the same secret and timestamp. Store the test account's TOTP secret in your CI/CD secrets and generate codes programmatically.
Debug clock synchronisation issues
If your server is rejecting valid TOTP codes, the most common cause is clock drift — the server's system clock and the user's device clock differ by more than the tolerance window. The "upcoming codes" panel shows codes for the next two windows. If any of them matches what your server expects instead of the "current" code, the server's clock is ahead of the tool's time. Verify the server's system clock is synchronised with NTP.
Test the window tolerance
RFC 6238 recommends accepting the previous and next time step (±30 seconds) to handle clock drift. Test your implementation by checking whether it accepts the code from the previous window (shown in the "upcoming" section — count backwards one period from now). If it rejects it, your implementation may be too strict. If it accepts codes from 3+ windows ago, it may be too lenient.
Verify digit and period configuration
The standard TOTP configuration is 6 digits and 30-second period, but some systems use 8 digits or 60-second periods. The tool's digit and period selectors let you test non-standard configurations. If your implementation generates different codes from this tool for the same secret, check that both are using the same digit count and period — mismatched configuration is a common integration bug.