The six digits, worked out on your own machine
Enter a TOTP secret you already own and see the current code, the countdown, and the codes either side for when clocks disagree. RFC 6238, computed in your browser, and the seed goes nowhere.
A TOTP seed is a shared secret, not something bound to a device. It is exactly as sensitive as a password, and losing it is worse — a password can be changed, whereas a leaked seed keeps producing valid codes until the factor is reset. Treat it accordingly, and do not paste one you do not own.
Processed locally in your browserNothing you enter here is uploaded, logged or sent to any server.
How a code is produced
- Take the current Unix time in seconds and divide by the period, discarding the remainder. That is the counter — every client with a correct clock computes the same one, and that is the entire synchronisation mechanism.
- Write the counter as eight bytes, big-endian, and compute an HMAC of it using the shared secret as the key.
- Take the low four bits of the last byte of the tag as an offset, read four bytes from there, mask off the top bit so the result is positive, and take the last six digits.
That last step is RFC 4226's dynamic truncation, and the masking is the part implementations forget — without it roughly half of all codes come out wrong. The engine here is checked against all eighteen published vectors in RFC 6238 appendix B, across SHA-1, SHA-256 and SHA-512.
Why SHA-1 is still the right default
SHA-1's practical weakness is collision resistance — the ability to construct two different inputs with the same digest. HMAC does not rely on that property, so HMAC-SHA-1 remains sound and there is no attack on TOTP because of it.
More to the point: nearly every authenticator app and service assumes SHA-1, and a mismatch produces codes that look perfectly normal and never work. If a service has not told you otherwise, it means SHA-1.
What this tool deliberately does not do
Nothing that helps anyone get past a factor they do not hold the seed for. There is no lookup, no service directory, no way to work backwards from a code, and no attempt to guess a seed. Everything here needs the secret you already own, and does exactly what an authenticator app on your phone does.
What this tool does not claim
No tool on this site is described as unbreakable, military grade, or completely secure, because none of those phrases means anything a person could check. What is written down instead is which standard is used, which library implements it, and what the tool has been tested against.
Everything here runs in your browser using its built-in Web Crypto implementation. Nothing is uploaded, and there is no server that could receive it. That is a real and checkable property — open your browser's network tab and use the tool.
When the code is rejected
Clock drift is the usual cause. TOTP depends entirely on both ends agreeing what time it is; a device a minute out produces codes for a different step. Servers commonly accept one step either side, which is why the neighbouring codes are shown here — if the previous or next code works, your clock is the problem, not the seed.
A digit-count or period mismatch produces codes that look completely normal and never work. Most services use six digits and thirty seconds; a few do not, and rarely say so anywhere obvious.
The wrong hash. Same symptom. If a service specified SHA-256 and the app assumed SHA-1, every code will be wrong and nothing will indicate why.
Where to keep a seed
In an authenticator app, and in one backup you control — written down and stored where you keep other valuables, or in a password manager. The failure people actually hit is not theft but loss: a phone dies and the codes are gone, and the recovery process is generally worse than the problem.
Storing the seed in the same password manager as the password does weaken the second factor into something closer to one and a half, since a single compromise reaches both. Whether that trade is worth making depends on what you are protecting against — losing your own access is a far commoner outcome than being targeted.
Related
The random generator produces Base32 values generally, and the encoding converter moves between Base32 and hex if you need the raw bytes.
Questions people actually ask
Is my seed sent anywhere?
No. It stays in the page, the HMAC is computed by your browser's Web Crypto implementation, and nothing is stored — reload the page and it is gone. Nothing on this page reports to analytics either.
My code is rejected. What is wrong?
Clock drift, most often. TOTP depends on both ends agreeing what time it is, and a device a minute out produces codes for a different step. The neighbouring codes are shown for exactly this reason: if the previous or next one works, your clock is the problem. After that, check the digit count, period and hash — a mismatch in any of them produces codes that look normal and never work.
Is SHA-1 a problem here?
No. SHA-1's practical weakness is collision resistance, and HMAC does not depend on that property, so HMAC-SHA-1 is sound. More practically, nearly every app and service assumes SHA-1 — if a service has not told you otherwise, it means SHA-1, and choosing something else will simply make every code wrong.
Can anyone with my seed log in as me?
They can generate every future code, forever. A seed is a shared secret rather than something bound to a device, so it is as sensitive as a password and worse to lose — a password can be changed, whereas a leaked seed keeps working until the whole factor is reset.
Where should I keep a backup?
Somewhere you control: written down with your other valuables, or in a password manager. The failure people actually hit is losing a phone, not being targeted. Keeping the seed beside the password does weaken the second factor towards one and a half, and whether that trade is right depends on what you are protecting against.
Can this bypass someone else's two-factor authentication?
No, and nothing here is built to. Everything requires the secret, which is the factor. There is no lookup, no way to work backwards from a code, and no guessing — it does what an authenticator app does, for seeds you already own.