TOTP one-time password/two-step authentication token simulator | ZeroTools

Generates and displays an OTP code for two-factor authentication that is updated every 30 seconds from a Google Authenticator-compatible secret key (Base32). It is a convenient web tool that operates completely locally and safely without sending data to an external server.

Loading tool interface...

Client-Side Secure Execution

This tool executes entirely in your browser sandbox. None of your input strings, files, or configurations are uploaded to any external server.

ZeroTools: Browser Processing & Privacy

ZeroTools focuses on tools that process input on your device. Check each tool’s scope and limitations before use.

Processing and privacy policy
Article Index
Chapter 1

Technical Specifications & Architecture

Check six-digit codes at 30-second intervals

This tool decodes a Base32 secret and calculates TOTP using HMAC-SHA1 and your device clock. The interface uses six digits and a 30-second step; SHA-256, SHA-512 and custom periods are not supported. The account must use the same secret and settings.

If a code is rejected, check automatic date/time settings and the account configuration. The countdown shows the next local code change. The service decides its tolerance for clock drift and reused codes.

The initial secret is a public demonstration key: never register it with a real account. New secrets use 160 random bits from Web Crypto, encoded as 32 Base32 characters. Generating a secret does not register it with any service. Anyone who knows the secret can calculate the same codes.

The calculation is checked against the SHA-1 vectors in RFC 6238 Appendix B. This page is not a secret vault or authentication service.