Running on your device · 0 bytes uploaded
TOTP generator and verifier
Compute RFC 6238 codes from an authenticator secret — and verify a code against the standard clock-drift window. WebCrypto HMAC in your tab; the secret never leaves it.
Lowercase, spaces, and dashes in base32 are tolerated.
- No otpauth:// QR generation, no account storage — this is the algorithm, not an authenticator app.
- A TOTP secret in anyone’s hands is that account’s second factor gone: pasting one anywhere (including here) is a handoff. Nothing is sent, stored, or logged — and a tab’s memory cannot be guaranteed zeroized.
- SHA-1 is the TOTP default because nearly every service uses it — the option list is honesty, not a recommendation.
Nothing in yet
Paste, drop, or type to begin. Everything stays on this device.
paste a secret and compute