日本語English

TOTP Studio (2FA Code Checker)

For developers testing two-factor authentication: compute TOTP and HOTP codes from a secret, and build or read otpauth:// URIs and QR codes. Everything runs with Web Crypto in your browser; the secret is never sent or stored.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Handle secrets with care
Typing a production account’s secret into a page run by someone else is risky in general. This tool never sends or stores the secret (nor puts it in the URL) and masks it by default, but mind screen sharing and browser extensions, and use a test secret where possible.
Settings
Type

Spaces, hyphens and lowercase are ignored.

0–5. Neighbouring codes are listed too.

Time to use

Codes are computed from your device clock. If it is off by tens of seconds, the codes will differ from the authentication server’s.

Code
Current code—
otpauth:// URI

Read

Paste an otpauth:// URI or load a QR image to fill in the settings above.

Load a QR image

PNG, JPEG, WebP… (up to 10 MB). Pasting (Ctrl+V) works too.Accepts: PNG / JPG / JPEG / WEBP / GIF / BMPUp to 10 MB per filePaste (Ctrl+V) also works
Check against RFC test vectors

Computes RFC 4226 Appendix D (10 HOTP values) and RFC 6238 Appendix B (18 TOTP values) in this browser and compares them.

What it cannot do
It cannot recover accounts on other services or compute non-standard codes such as Steam Guard. A Google Authenticator migration QR can be inspected only when it can be read.

How to use

  1. Secret
    otpauth:// URI

    Enter the secret (Base32)

  2. 6-digit codeupdates every step

    Compute the code from the time

  3. QR image (PNG)
    Check against RFC values

    Check with a QR or values

Compute the current code from a secret and make a QR for authenticator apps

  1. Click “Try a sample” or enter a Base32 secret (“Generate random” makes a fresh one).

  2. Choose TOTP or HOTP, the algorithm (SHA-1 / SHA-256 / SHA-512), digits and period (or counter for HOTP) to match the service you are checking.

  3. The current code and the seconds left are shown. Raise “Steps either side” to list the codes of neighbouring time steps too.

  4. The otpauth:// URI and QR code appear only after you click “Show secret”. You can copy the URI or save the QR as PNG.

  5. Paste an existing otpauth:// URI or load a QR image to fill in the issuer, account, algorithm, digits and period.

  6. Use “Check against RFC test vectors” to confirm this tool’s maths matches the official RFC 4226 / 6238 values.

What it does

Self-test against the RFC vectors

Computes all 28 official values in your browser and compares them: RFC 4226 Appendix D (HOTP counters 0–9) and RFC 6238 Appendix B (TOTP, SHA-1 / SHA-256 / SHA-512 at six times).

See clock drift

Shows the seconds left and the codes up to ±5 steps around now, so you can find which step matches the other side when a device clock runs fast or slow. You can also set the time as Unix seconds.

Build and read otpauth://

Create a URI and QR code (saved as PNG) from issuer, account, algorithm, digits and period (or counter for HOTP). Existing URIs and QR images are broken down field by field.

Built so the secret stays local

The secret is masked by default. Input and HMAC run entirely in your browser with Web Crypto; nothing is sent, put in the URL or saved in browser storage. Analytics never include the secret or URI.

Google Authenticator export QR

An otpauth-migration:// QR (the export format) is listed account by account when it can be read, and you can load one account into the form. Unsupported entries such as MD5 are not imported.

Use cases

  • Compare the codes your service’s 2FA implementation produces with another implementation
  • Check the issuer, digits, period and algorithm inside a QR code’s otpauth:// before enrolling
  • Tell whether a code mismatch comes from clock drift (the right code shows up in a neighbouring step)
  • Build an otpauth:// URI and QR code for a test account in a development environment
  • Step an HOTP counter to see how a server’s resynchronisation window behaves

Capability matrix

FeatureSupportNotes
TOTP / HOTP code calculation (SHA-1, SHA-256, SHA-512; 6–8 digits)Supported—
Neighbouring codes, seconds left, time as Unix secondsSupported—
Build otpauth:// URIs, show the QR code, save as PNGSupported—
Read from QR images and URIs (issuer, account, algorithm, digits, period)Supported—
Read otpauth-migration:// (Google Authenticator export)PartialOnly QR codes that can be read; entries such as MD5 and the other images of a multi-image export are not imported
Recover other services’ accounts or extract secrets from themNot supportedThis tool only computes and inspects codes; use each service’s own recovery process
Correct the device clockNot supportedYou can see the drift, but the clock itself must be fixed with your OS time sync
Steam Guard or other non-standard schemes, digits outside 6–8Not supportedOnly schemes following RFC 4226 / 6238

Limits & notes

  • Secrets up to 256 Base32 characters; otpauth:// URIs up to 4096 characters.
  • Digits 6–8, TOTP period 5–300 seconds, and up to ±5 steps either side.
  • QR images up to 10 MB. Decoding loads a WebAssembly module (ZXing) from this site.
  • Codes use your device clock (or the Unix time you set). If the clock is off, the codes will differ from the authentication server’s.
  • Entering a production secret carries the same risk as typing it into any third-party site; use a test secret where possible.
  • Works on phones too. QR codes are read from an image file you choose.

Privacy & safety

Secrets, otpauth:// URIs and QR images are processed entirely in your browser (Web Crypto and WebAssembly) and never sent to a server. Nothing is written to the URL or browser storage, and everything is gone when you close the page. Analytics only receive usage counts and error types, never secrets or account names.

FAQ

How is a TOTP code calculated?
The secret and the integer “current time ÷ period (usually 30 s)” go through HMAC (SHA-1 etc.), and the low digits are extracted as a 6-digit number (RFC 6238). The server and app use the same secret and time, so they get the same code.
Why does my two-factor code not match?
Most often the device clock is more than ±30 seconds off. Raise “Steps either side” and see which neighbouring step shows the code the server expects; that tells you the direction and size of the drift. Turn on OS time sync.
What is inside a 2FA QR code?
Usually an otpauth:// string with the issuer, account name, secret, algorithm, digits and period. This tool lists them field by field and keeps the secret masked until you click “Show”.
How do I build an otpauth:// URI?
Use otpauth://totp/Issuer:account?secret=BASE32&issuer=Issuer&algorithm=SHA1&digits=6&period=30. Filling in the form here builds the URI and QR code for you. Issuer and account must not contain “:”.
Is it safe to enter a production secret?
This tool does not send or store it, but typing a production secret into a page run by someone else is risky in general. Mind screen sharing and browser extensions, and try a test secret if you can.
Can it recover my account on another service?
No. It only computes codes from a secret you already have. If you lost your authenticator, use the service’s backup codes or recovery process.

Crypto Studio — Hash, HMAC, Encryption & Keys

Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.

No upload

QR & Barcode Studio

Build QR codes from templates for Wi-Fi, contacts, events and more, and barcodes such as EAN or Code 128 with automatic check digits. Export PNG or SVG, or batch-create one code per line.

No upload

QR Code & Barcode Reader

Drop an image or point your camera to read QR codes and barcodes. URLs are never opened automatically — you see the real destination domain and phishing warnings first. Everything runs on your device.

No upload

Password Studio — Generator & Strength Checker

A strong 20-character password is ready when the page opens. Fine-tune symbols and excluded characters, switch to a memorable passphrase, or check a password you already use — all without sending anything off your device.

No upload

Certificate, CSR & PEM Studio

Reads PEM, DER (.cer/.crt), CSR and PKCS#7 (.p7b) and lists the subject, expiry (days left), SANs, public key, signature algorithm and SHA-256 fingerprint. It also checks chain order and signatures and converts PEM and DER. Everything runs in your browser and private keys are never read.

No uploadBeta

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

Last updated: