TOTP generator and clock-skew test
Generate SHA-1, SHA-256, or SHA-512 time-based codes with 6 or 8 digits and inspect values around refresh boundaries.
LOCAL 2FA LAB
A trusted reference for every OTP implementation.
Compare app and server output, diagnose time drift, validate otpauth parameters, and create test fixtures from one private browser workspace.
Computed locally · no Secret is uploaded
TOTP / SHA-1------
30s remaining
!Use temporary test secrets only. Saved configurations remain in this browser and are not encrypted.
01 / CONFIG
Shared configuration
Saved test configurations
No saved configurations yet.
02 / OTPAUTH
QR import + app check
Generate a standards-based otpauth URI, scan it with Spot Auth or another authenticator, then compare the app code here.
⌗otpauth://
Live TOTP------30s remaining
03
Live TOTP
------
04
HOTP counter
------
05
Code verification
06 / FIXTURES
Regression vectors
Generate deterministic time → TOTP fixtures for unit tests and cross-language comparisons.
07 / GUIDE
A clean debugging sequence
- 01
Confirm Secret, algorithm, digits, and period match on both sides.
- 02
Scan the generated QR and compare the current app code.
- 03
Use the drift test when failures happen near a refresh boundary.
- 04
Export fixed vectors before changing an OTP implementation.
Build and debug OTP against a local reference.
Use one configuration to exercise the full implementation path: Base32 secret handling, HMAC algorithm, digit truncation, time step or counter, otpauth provisioning, verification windows, and repeatable fixtures. Calculations stay in this browser.
What this 2FA test tool covers
HOTP counter reference
Generate counter-based OTP values from the same Base32 secret and advance the moving counter one step at a time.
otpauth QR code generator
Create a standards-compatible provisioning URI, scan it with an authenticator, and compare the code shown by the app.
Verification and test vectors
Check an OTP within a configurable window, then export deterministic Unix-time-to-TOTP fixtures for automated tests.
TOTP and HOTP use the same secret differently
Both derive short codes from a shared secret and HMAC. The moving factor is what changes: time for TOTP, an agreed counter for HOTP.
| TOTP · RFC 6238 | HOTP · RFC 4226 | |
|---|---|---|
| Moving factor | Unix time divided into fixed steps | Monotonically increasing counter |
| Common baseline | 30 seconds · 6 digits · HMAC-SHA-1 | 6 digits · HMAC-SHA-1 |
| Typical mismatch | Clock drift, period, digits, algorithm, or secret | Counter desynchronization, digits, or secret |
2FA implementation questions
01Can the same Base32 secret generate both TOTP and HOTP?+
Yes. The secret is shared key material. TOTP derives its moving factor from time, while HOTP uses a counter; the provisioning type and verifier must agree on the mode.
02Why does my authenticator code differ from the server?+
Compare the decoded secret, algorithm, digit count, period, and current time first. For HOTP, also confirm the counter. Boundary-only failures usually indicate clock skew or a verification-window issue.
03Should I paste a production 2FA secret here?+
No. Use temporary test secrets only. Calculations are local, but saved configurations remain unencrypted in this browser and a test environment should never depend on a live credential.
04Does a valid otpauth QR guarantee compatibility?+
No. It proves the URI can be encoded and scanned. Confirm how each client handles issuer, account label, algorithm, digits, period or counter, and test the resulting code against your server.