TOTP Bench / local

What is this

TOTP Bench is a free online TOTP generator and authenticator test tool. It mints a random base32 secret, builds the otpauth:// URI, renders the enrollment QR code, and shows the current one-time code counting down in real time. Use it to test a two-factor login flow, generate fixtures for automated tests, or check that your server and your authenticator app agree on a code.

How TOTP works

A time-based one-time password (RFC 6238) is HOTP (RFC 4226) with the counter set to the current Unix time divided by a period, usually 30 seconds. Both sides compute HMAC(secret, counter), truncate the hash to 31 bits, and take the last 6 or 8 decimal digits. Because the only inputs are the shared secret and the clock, no network round trip is needed to verify a code.

Fields

Shared secret is the base32-encoded key. Paste one from a real enrollment to see the same codes your authenticator shows, or press New for a fresh 160-bit key. Account and Issuer are only labels: they appear in the authenticator app's list and change nothing about the code. Algorithm, digits and period match the parameters most services use, so leave them at SHA1 / 6 / 30 unless you are testing something unusual.

Privacy

Everything runs client-side with the Web Crypto API. The page makes no requests with your secret, stores nothing, and works offline once loaded. That also means a secret you mint here is only as safe as the tab it lives in: use it for testing, and enroll production accounts through the real service.