TOTP 2FA Authenticator Tester & Generator
Inspect, debug, and test two-factor authentication (TOTP) codes. Scan generated QR codes into your mobile authenticator app and simulate server validation windows.
Works with Google Authenticator, Authy, Bitwarden, and 1Password.
How Time-Based One-Time Passwords (TOTP RFC 6238) Work
The Mathematical Pipeline: From Unix Epoch to 6-Digit Code
TOTP is an extension of the HMAC-based One-Time Password algorithm (HOTP RFC 4226). Instead of an incrementing transaction counter, TOTP uses the current Unix time divided into 30-second intervals:
The 8-byte big-endian representation of T is signed using HMAC-SHA1 with the Base32 shared secret key. The resulting 20-byte hash is dynamically truncated using the lower 4 bits of the last byte as an offset, extracting a 31-bit integer modulo 1,000,000 to produce the 6-digit code.
Handling Network Latency & Device Clock Drift
Because client mobile phone clocks and server clocks can differ by several seconds, standard RFC 6238 authentication servers implement a drift tolerance window.
A standard verification check computes the expected code for T-1 (previous 30s), T (current 30s), and T+1 (next 30s). If the submitted code matches any of these three windows, the user is authenticated.