TOTP Tester
Generate and verify time-based one-time password (TOTP) codes using your Base32 secret. Useful for validating MFA setup before deploying to production.
Spaces and lowercase letters are accepted. Invalid characters are rejected.
Enter a code and click Verify.
Authenticator App QR Code
Live QRScan with Google Authenticator, Microsoft Authenticator, 1Password, or Authy
How to use this tester
TOTP is based on a shared secret and the current Unix timestamp. Both your authenticator app and your server run the same algorithm with the same time window. If clocks drift or the secret is malformed, users will see "invalid code" errors even when they type correctly.
This tester helps you validate those implementation details quickly. Paste the Base32 secret, choose the same period and digit length your server expects, and scan the QR code into your authenticator app. If the generated codes match, your configuration is correct.
The verify box checks the entered token against the current window and a small tolerance around it to mirror practical server-side behavior.
Related Tools
All Security Tools →SAML Response Analyzer & Validator
Decode, validate, and inspect SAML Response XML online. Veri...
Hash Generator
Generate MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 h...
HMAC Generator & Webhook Signature Verifier
Generate HMAC-SHA256, SHA-1 and SHA-512 signatures and verif...
Helm Values Tool
Compare and merge Helm values.yaml files the way Helm does,...
Log Analyzer
Parse Nginx/Apache access logs, JSON logs and plain applicat...
SLA & Uptime Calculator
Convert an SLA percentage such as 99.9% into allowed downtim...