Online Tool Store
· 3 min read
How to Generate and Test TOTP Codes
Manesh Jayawardhana
CIO & Co-founder
Two-factor authentication codes look like six random digits, but they are generated from a shared secret and the current time. When a code fails, the cause might be the secret, the algorithm, the number of digits, the time period, or clock drift. Guessing at the problem is slow.
A TOTP code generator helps you generate, inspect, and verify time-based one-time passwords in the browser, with controls for algorithm, period, digits, and otpauth URI setup.
What TOTP generation involves
TOTP stands for time-based one-time password. It combines a secret key with a time counter, then calculates a short code using an HMAC algorithm. Most authenticator apps use 6 digits and a 30-second period, but other settings exist.
An otpauth:// URI packages the issuer, account, secret, algorithm, digits, and period so authenticator apps can import the setup.
Why people get stuck here
Most TOTP failures are configuration mismatches. The app and server must agree on the secret, algorithm, digit count, and time period. A small clock difference can also make a valid code appear expired or not yet active.
Testing with a clear verifier helps separate setup mistakes from time drift.
| Setting | Common Default |
|---|---|
| Digits | 6 |
| Period | 30 seconds |
| Algorithm | SHA-1 in many systems |
| Secret | Shared between verifier and app |
What a good TOTP test looks like
Settings are explicit
Do not assume every system uses the same algorithm or digit count.
Clock drift is visible
The verifier should show whether a code is close but outside the expected time window.
URI contents are inspectable
An otpauth URI should be decoded so you can verify issuer, account, and parameters.
Common mistakes to avoid
- Copying the wrong secret. One missing or extra character breaks codes.
- Ignoring clock drift. Server and device time must be close.
- Assuming SHA-1 always. Some systems use SHA-256 or SHA-512.
- Sharing real 2FA secrets casually. Treat secrets like passwords.
How to do it with TOTP Code Generator
- Open the free TOTP Code Generator.
- Enter or generate a TOTP secret.
- Set the algorithm, digit count, and period.
- Generate the current code.
- Use the verifier to test a code and inspect clock-drift feedback.
- Create or inspect an
otpauth://URI when setting up an authenticator app.
This is useful for testing integrations and understanding why a one-time code is accepted or rejected.
Frequently asked questions
What is an otpauth URI?
It is a setup URL that authenticator apps use to import account name, issuer, secret, and TOTP settings.
Why did my valid-looking code fail?
The secret, algorithm, digit count, period, or clock may not match the verifier.
Are TOTP secrets sensitive?
Yes. Anyone with the secret can generate valid codes, so protect it carefully.
Final thought
TOTP is reliable when both sides agree on the same inputs and time. A generator makes those assumptions visible.