Free tool

TOTP Bench

Make a TOTP secret, scan it into an authenticator app, then check the codes it shows. Everything runs in this page. Nothing is sent anywhere.

Secret and settings

Issuer

Account

Secret (base32)

Algorithm

Digits

Period (s)

Google Authenticator and most phone apps only honour SHA1, 6 digits and 30 s. Change them only when your own app reads the link.

Current code SHA1 · 6 digits · 30 s

--- ---

Changes in -- s

Next code

--- ---

Scan it

Add an account in your authenticator app and scan this. It should show the same code as the panel above.

Enter a valid secret

otpauth link

To share it, send the secret or the link. The other person opens this page, picks Validator and pastes it.

Check a code

Secret or otpauth link

Prefilled from the Generator. Paste another secret or link to test a different one.

Algorithm

Digits

Period (s)

Accept drift of ±

Check at (Unix s)

Code from the app

Leave “Check at” empty to use the current time. The RFC sample loads SHA1, 8 digits, time 59 and code 94287082, so you can compare your own app against the reference.

Waiting for a secret

Codes in the window

Show expected codes

Step	Counter	Starts at	Code
Enter a valid secret to see the window.

A real server should also remember the last accepted step and refuse the same code twice.

Codes follow RFC 6238 (HMAC-SHA1, SHA256 or SHA512, 30 s default). The last secret and settings are kept in this browser's local storage so a refresh does not break the code on your phone.