Your files stay on your device
TOTP generator and verifier
Compute RFC 6238 codes from an authenticator secret and verify a code against the standard clock-drift window. WebCrypto HMAC in your tab; the secret never leaves it.
Loads its secret and parameters into the form (plan 04 WEB-1).
Lowercase, spaces, and dashes in base32 are tolerated.
- No account storage: secrets live in this tab only; this is the algorithm, not an authenticator app.
- A TOTP secret in anyone’s hands is that account’s second factor gone: pasting one anywhere (including here) is a handoff. Nothing is sent, stored, or logged, and a tab’s memory cannot be guaranteed zeroized.
- SHA-1 is the TOTP default because nearly every service uses it. The option list is honesty, not a recommendation.
Paste, drop, or type to begin. Everything stays on this device.