2FA Code Tester

Test and verify TOTP (Time-based One-Time Password) codes from authenticator apps. Debug 2FA setup issues and verify your authentication is working correctly.

The secret key from your 2FA setup (base32 encoded)

Verify Your Code

About TOTP

TOTP codes change every 30 seconds based on the current time

Your device time must be accurate for codes to work

All processing happens locally in your browser

How to Test Your 2FA Codes

  1. 1

    Enter Your Secret Key

    Paste the base32-encoded secret key from your 2FA provider into the secret key field. This is the key you receive during initial two-factor authentication setup, often shown alongside a QR code. You can also click Generate Sample Secret to create a test key.
  2. 2

    View the Generated TOTP Code

    The tool instantly generates the current six-digit TOTP code based on your secret and the current time. A countdown timer shows how many seconds remain before the code rotates to a new value. Each code is valid for exactly 30 seconds.
  3. 3

    Enter the Code from Your Authenticator App

    Open your authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or any TOTP-compatible app) and type the six-digit code it displays into the verification field on this page.
  4. 4

    Verify and Troubleshoot

    Click Verify Code to check whether the code from your app matches the expected value. If verification fails, the most common cause is a time sync issue between your device and the server. Check that your device clock is set to automatic and retry.

When to Use a 2FA Code Tester

1

Integrating 2FA Into Your Application

Developers building login systems need to verify that TOTP generation and validation logic work correctly before shipping to production. This tester lets you confirm your secret key produces the expected codes and that your server-side verification window handles clock drift properly.
2

Troubleshooting Authentication Failures

When users report that their authenticator codes are being rejected, you can paste the shared secret into this tool to compare the expected code with what the user sees. Time desynchronization and incorrect secret key encoding are the two most frequent root causes.
3

Migrating Authenticator Apps

Switching from one authenticator app to another requires re-entering secret keys. Use this tester to confirm that the new app generates identical codes before disabling the old one, avoiding accidental account lockout.
4

Security Audits and Compliance

During security reviews, teams need to verify that two-factor authentication is correctly enforced across all critical accounts. This tool provides a quick way to validate TOTP configurations without logging into each service individually.

Why Test 2FA Codes?

Two-factor authentication adds crucial security to your accounts. This tool helps debug setup issues, verify time synchronization, and test TOTP implementations.

Two-factor authentication (2FA) is one of the most effective defenses against unauthorized account access. The TOTP standard, defined in RFC 6238, generates a new six-digit code every 30 seconds using a shared secret key and the current Unix timestamp. Our 2FA Code Tester lets you generate, compare, and verify these codes entirely in your browser with zero data sent to any server. Whether you are a developer integrating TOTP into a login flow or an end user debugging a rejected code, this tool gives you instant answers. Pair it with our Password Generator to build a complete credential security workflow.

Rejected TOTP codes are almost always caused by time synchronization problems or incorrectly encoded secret keys. This tester removes the guesswork by showing you exactly what code your secret should produce at the current moment. If the code in your authenticator app does not match, you know the issue is on the app side. If it does match but the server still rejects it, the problem lies in the server's verification window or clock. For deeper token inspection, try our JWT Decoder to analyze authentication tokens returned after successful 2FA login.

Beyond troubleshooting, the 2FA Code Tester is invaluable during development and QA. You can generate sample secrets, verify codes against known test vectors, and confirm that your implementation handles edge cases like clock drift and adjacent time-step acceptance. When combined with our HMAC Generator and Hash Comparison Tool, you have a complete suite for validating the cryptographic primitives that underpin TOTP authentication.

How It Compares

Several online TOTP testers exist, but most require you to paste your secret key into a form that sends it to a remote server for processing. This creates a serious security risk: if the server is compromised or logs requests, your 2FA secret is exposed and an attacker can generate valid codes for your account. The FindUtils 2FA Code Tester runs all cryptographic operations client-side using JavaScript. Your secret key never leaves your browser, making it safe to test even production secrets.

Compared to desktop authenticator applications, this tool has a distinct advantage for debugging: it shows you both the expected code and a live countdown, so you can visually confirm synchronization. Desktop apps like Google Authenticator display only the current code without revealing the underlying secret or timing details. For developers, the ability to paste any base32 secret and instantly see the resulting code stream is far faster than manually adding and removing test accounts in a mobile app.

Tips for Reliable 2FA

1
Always keep your device clock set to automatic network time. Even a 30-second drift can cause TOTP codes to fail.
2
Store backup codes in a secure location such as an encrypted password manager. If you lose access to your authenticator app, backup codes are your only recovery path.
3
When setting up 2FA, save the secret key or QR code before activating it. This allows you to re-add the account to a new device without contacting support.
4
Use a TOTP app that supports encrypted cloud backup (like Authy or 1Password) so you do not lose all your tokens if your phone is lost or damaged.
5
Test your 2FA codes immediately after setup. Do not close the setup page until you have confirmed the code from your authenticator matches and is accepted.

Frequently Asked Questions

1

What is TOTP?

Time-based One-Time Password (TOTP) generates temporary codes that change every 30 seconds, based on a shared secret and current time. It is defined in RFC 6238 and is the standard behind most authenticator apps including Google Authenticator, Authy, and Microsoft Authenticator.
2

Why might my codes not work?

Common issues include incorrect time on your device, wrong secret key, or the account being set up with a different algorithm. Ensure your device time is synced to network time. Even a 30-second offset can cause every code to be rejected.
3

Is it safe to enter my secret here?

All processing happens locally in your browser. Your secret key is never sent to any server. The TOTP computation runs entirely in client-side JavaScript, so your secret remains private even on shared networks.
4

What apps work with TOTP?

Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and many other apps support TOTP. Any app compliant with RFC 6238 will work. Hardware tokens like YubiKey also support TOTP.
5

What is a base32 secret key?

A base32 secret key is the shared secret encoded using the base32 alphabet (A-Z and 2-7). It is the format used by virtually all TOTP providers. You receive this key during 2FA setup, either as a text string or embedded in a QR code.

Rate This Tool

0/1000

Get Weekly Tools

Suggest a Tool