Two Fa Code Tester

Security REST API MCP

Compute the current TOTP code (RFC 6238) for a base32 secret and return the code, the seconds remaining in the window, and — when a code is supplied — whether it matches. Defaults match Google Authenticator: 6 digits, 30-second period, HMAC-SHA1. Pass "time" (unix seconds) to evaluate a specific moment.

This page documents the MCP tool findutils:two_fa_code_tester. See the REST reference →

Use in the browser View as Markdown

Call it over MCP

Tool name findutils:two_fa_code_tester · no API keys · 120 requests/min per IP

Claude Code

claude mcp add findutils --transport http https://mcp.findutils.com/

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "findutils": {
      "url": "https://mcp.findutils.com/"
    }
  }
}

Raw JSON-RPC (any MCP client) — verified example

curl -X POST https://mcp.findutils.com/ \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "two_fa_code_tester",
      "arguments": {
        "secret": "JBSWY3DPEHPK3PXP"
      }
    }
  }'

Input schema

Argument	Type	Required	Description
secret	string	yes	The base32 TOTP secret (e.g. JBSWY3DPEHPK3PXP). Spaces, dashes, and padding are ignored.
code	string	no	Optional code to verify against the computed one.
digits	integer	no	Number of digits. Default: 6. Default: 6.
period	integer	no	Time step in seconds. Default: 30. Default: 30.
time	integer	no	Unix timestamp (seconds) to compute the code for. Default: now.
algorithm	string (SHA-1 \| SHA-256 \| SHA-512)	no	HMAC hash. Default: SHA-1. Default: "SHA-1".

Example arguments (verified)

{
  "secret": "JBSWY3DPEHPK3PXP"
}

Also a REST endpoint

The same tool answers plain HTTP at POST /api/tools/two-fa-code-tester/execute — no key, 60 requests/min.

Open the REST reference for Two Fa Code Tester →

More Security tools

Base32 Encode

Encode UTF-8 text to RFC 4648 base32 (uppercase, "=" padding).

Data Sanitizer

Sanitize untrusted text and return the cleaned output, a list of changes made, and a risk level.

Dnpm Configurator

Returns the five files of a hardened Docker-based npm wrapper (the ./dnpm bash script, .dnpm/Dockerfile, docker-compose.node.yml, .dnpm/secc

Email Header Analyzer

Return a structured analysis of raw email headers: sender, recipient, subject, date, message id, the Received hop chain with per-hop delays,

Hash Comparison Tool

Hash text with SHA-1, SHA-256, SHA-384, or SHA-512 and compare the hex digest with an expected hash.

Jwt Decode

Decode a JWT header + payload.

Jwt Generator

Generate a signed JWT (HS256, HS384, or HS512 via HMAC) and return the token plus the decoded header and payload.

Jwt Security Validator

Decode a JWT and return a list of security checks (algorithm strength, expiration, not-before, issued-at, issuer, audience, subject, signatu