TOTP / HOTP Codes

What it's for

Make the one-time codes that authenticator apps show for two-factor sign-in, from the secret behind them, and the QR code that adds a secret to an app. Time-based codes (TOTP) change every 30 seconds; counter-based ones (HOTP) change each time they’re used.

• When you’re testing two-factor sign-in on an application you’re building, and want codes without reaching for a phone.
• When you’re moving an account to a new authenticator and have its setup key or otpauth:// link.
• When you’re checking that a secret and an app agree.

How to use it

Paste a Base32 secret (the “setup key” a site shows beside its QR code) or a whole otpauth:// link, or choose Make a new secret. The current code appears with the next and previous ones and a countdown, each with Copy and Spell it out buttons. A link carries its own settings; for a bare secret, choose the kind, algorithm, digits, period or counter, and an issuer and account name for the QR code. Scan the QR code with an authenticator app to add the secret to it, or copy the otpauth:// link.

Type a code under Check a code to see whether it’s right now, or for the period either side, which most services also accept to allow for clocks that drift.

Example

Paste this secret (the RFC 4226 test secret, 12345678901234567890 in Base32), choose HOTP and leave the counter at 0:

GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ

The code for counter 0 is 755224, and for counter 1 287082, as the standard says.

Good to know

Codes depend on this device’s clock, so a clock that’s wrong by more than a period gives wrong time-based codes. The secret is never saved or put in a link, but anyone with it can make your codes, so don’t paste the secret of an account you care about into a device you don’t trust. Steam’s and other non-standard codes aren’t supported.