How TOTP works
When you scan a 2FA QR code, the app stores a shared secret, typically 20 random bytes shown as a 32-character Base32 string. Every 30 seconds it computes HMAC-SHA1(secret, ⌊now / 30⌋), takes four bytes from the result at an offset given by its last nibble, and reduces that number modulo 10⁶ to get six digits. The server does the same, usually accepting the previous and next window as well to allow for clock drift. There is no network involved on the phone, which is why authenticator apps work offline.
The otpauth URI
The QR code contains a URI like otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example&digits=6&period=30&algorithm=SHA1. Pasting it here fills in every parameter. Most services use the defaults (SHA-1, 6 digits, 30 s); a few use 8 digits or SHA-256, and some apps ignore the algorithm parameter, which is a common cause of “the code is wrong” tickets.
Debugging a 2FA setup
- Put the secret here and in the app; the codes must agree. If not, the secret was mis-typed or the app ignores the parameters.
- If the codes agree but the server rejects them, the server's clock is off. TOTP depends on both sides agreeing on the time to within the window.
- Check the server verifies with a window of ±1 and rejects reuse of the same code (replay).
Security notes
The secret is the whole security: anyone who has it can generate codes forever. Store it encrypted, never log it, and prefer WebAuthn / passkeys where possible, since TOTP codes can be phished in real time. This page is for developers testing their own setup; treat any secret you paste into a browser as test data.
Questions
Why is my code different from the app?
Check that the secret is identical (Base32 ignores case and spaces but every letter matters), that the digits, period and algorithm match what the service specified, and that your computer clock is correct. A code that is off by exactly one window means a clock difference of about 30 seconds.
What is the Base32 alphabet?
A–Z and 2–7; no 0, 1, 8 or 9, so secrets are unambiguous when read aloud. Padding = is optional. The tool rejects other characters and tells you which.
What is the difference between TOTP and HOTP?
HOTP (RFC 4226) uses a counter that increments on every use; TOTP (RFC 6238) replaces the counter with the current time divided by the period. Hardware tokens with a button are HOTP; apps are TOTP. Enter a counter above to compute HOTP.
Can I generate codes for Google Authenticator or Authy?
Yes, both implement standard TOTP. Steam Guard and some banking apps use proprietary variants that this tool does not reproduce.