Your files stay on your device

# TOTP generator and verifier

Compute RFC 6238 codes from an authenticator secret and verify a code against the standard clock-drift window. WebCrypto HMAC in your tab; the secret never leaves it.
Base32 (authenticator apps)HexPaste an otpauth:// URI

Loads its secret and parameters into the form (plan 04 WEB-1).
Secret

Lowercase, spaces, and dashes in base32 are tolerated.
Digits678AlgorithmSHA-1SHA-256SHA-512Compute codeCode to checkVerify

- No account storage: secrets live in this tab only; this is the algorithm, not an authenticator app.
- A TOTP secret in anyone’s hands is that account’s second factor gone: pasting one anywhere (including here) is a handoff. Nothing is sent, stored, or logged, and a tab’s memory cannot be guaranteed zeroized.
- SHA-1 is the TOTP default because nearly every service uses it. The option list is honesty, not a recommendation.
Paste, drop, or type to begin. Everything stays on this device.

## More web & auth tools

- [JWT decoder](/web/jwt)
- [HMAC](/crypto/hmac)
[All web & auth tools](/web)

---

Canonical HTML: https://nutter.tools/web/totp/
Markdown version: https://nutter.tools/web/totp/index.md
Plain-text version: https://nutter.tools/web/totp/index.txt
Agent index: https://nutter.tools/llms.txt