ShareYourGroupShareYourGroupTwo-Factor Codes

One-time code tester

Make TOTP and HOTP codes, check clock drift and build an otpauth address.

Do not type the secret of a real account here. The code runs in your browser and nothing is sent anywhere, but a secret you type into any web page is a secret you have shown to that page. Use a test secret (press "Make a random secret").

Address for an authenticator app

(type a secret first)

Read an address

What the tester is for

It makes the six-digit codes that authenticator apps show, from the same kind of secret, so that you can test a login system you are building, check that a secret was copied correctly, or learn how the codes work.

How to use it

  1. Press "Make a random secret", or type a Base32 secret, or press "Use the RFC test secret".
  2. Choose the type (time based or counter based), hash, digits and step. The defaults are the common ones: TOTP, SHA-1, 6 digits, 30 seconds.
  3. Read the code. The page also shows the previous and next codes: a server that allows one step of clock drift accepts all three.
  4. Change "Clock difference" to see what a phone whose clock is off would show.

Keep real secrets out

A secret you type into any web page is a secret that page has seen. This page runs in your browser and sends nothing, but the safest habit is to use test secrets here and keep real ones in your authenticator app.

Why do I see the same code as my phone?

If the secret, the hash, the digits and the step are the same, and both clocks agree, the code is the same. It is a calculation, not a message.

Does it work offline?

Yes, after the page has loaded. The codes come from your device's clock.

Guides RFC test vectors

This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.