Running on your device · 0 bytes uploaded

# TOTP generator and verifier

Compute RFC 6238 codes from an authenticator secret — and verify a code against the standard clock-drift window. WebCrypto HMAC in your tab; the secret never leaves it.
Base32 (authenticator apps)HexSecret

Lowercase, spaces, and dashes in base32 are tolerated.
Digits678AlgorithmSHA-1SHA-256SHA-512Compute codeCode to checkVerify

- No otpauth:// QR generation, no account storage — this is the algorithm, not an authenticator app.
- A TOTP secret in anyone’s hands is that account’s second factor gone: pasting one anywhere (including here) is a handoff. Nothing is sent, stored, or logged — and a tab’s memory cannot be guaranteed zeroized.
- SHA-1 is the TOTP default because nearly every service uses it — the option list is honesty, not a recommendation.
Nothing in yet

Paste, drop, or type to begin. Everything stays on this device.

paste a secret and compute

## Next door in Web

- [JWT decoder](/web/jwt)
- [HMAC](/crypto/hmac)
[All web tools](/web)

---

Canonical HTML: https://nutter.tools/web/totp
Markdown version: https://nutter.tools/web/totp/index.md
Plain-text version: https://nutter.tools/web/totp/index.txt
Agent index: https://nutter.tools/llms.txt