How to generate a TOTP code from a secret

The six digits an authenticator app shows are a function of your secret and the current time. Nothing else.

TOTP is the standard behind almost every authenticator app. You and the service share a secret once, at setup. After that, both sides compute a code from that secret and the current 30-second time step. No network traffic is involved in producing a code — which is why authenticator apps work in aeroplane mode.

Step-by-step

1. Enter your secret, as Base32, or paste the whole otpauth:// URI from a setup page.
2. Read the current code and the countdown to the next one.
3. Check the neighbouring codes if the service rejects yours — see below.

When a code is rejected but looks right

Nearly always a clock problem. Both sides derive the code from the current time, so if your device's clock is a minute out you will be generating a code the server considers expired. Servers usually accept the immediately previous and next steps to allow for this, which is why the tool shows the neighbours as well as the current code — if the server accepts your "previous" code, your clock is running fast, and you should fix it rather than keep compensating.

Legitimate uses, and the honest caveat

This tool is for secrets you own: checking that a seed you have backed up still produces the right codes, recovering access when a phone has been lost but the seed was saved, or testing a TOTP implementation you are building against the RFC vectors.

It is not a substitute for an authenticator app on a day-to-day basis. Typing your seed into a browser page is fine for a one-off check; keeping it in a browser tab beside the password it protects defeats much of the purpose of a second factor, which is that the second factor lives somewhere else.

Standards and vectors

TOTP is RFC 6238, built on the HOTP construction in RFC 4226. Both include published test vectors, and all eighteen of the RFC 6238 vectors are in this project's test suite — including the SHA-256 and SHA-512 variants, which are commonly implemented wrongly because the reference table uses a different seed for each.

Frequently asked questions

Is my TOTP secret sent anywhere?

No. It stays in your browser and is used only to compute codes locally. No analytics event on the page may carry it.

My code is rejected but the tool shows it as current. Why?

Your device clock is probably out of step with the server's. Check whether the previous or next code is accepted, then correct your system clock rather than working around it.

Can I use this instead of an authenticator app?

For occasional checks and recovery, yes. As a daily replacement it is a poor idea, because keeping the seed in the same place as your password removes much of the benefit of a second factor.