The secret key from your 2FA setup (base32 encoded)
Verify Your Code
About TOTP
TOTP codes change every 30 seconds based on the current time
Your device time must be accurate for codes to work
All processing happens locally in your browser
How to Test Your 2FA Codes
- 1
Enter Your Secret Key
Paste the base32-encoded secret key from your 2FA provider into the secret key field. This is the key you receive during initial two-factor authentication setup, often shown alongside a QR code. You can also click Generate Sample Secret to create a test key. - 2
View the Generated TOTP Code
The tool instantly generates the current six-digit TOTP code based on your secret and the current time. A countdown timer shows how many seconds remain before the code rotates to a new value. Each code is valid for exactly 30 seconds. - 3
Enter the Code from Your Authenticator App
Open your authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or any TOTP-compatible app) and type the six-digit code it displays into the verification field on this page. - 4
Verify and Troubleshoot
Click Verify Code to check whether the code from your app matches the expected value. If verification fails, the most common cause is a time sync issue between your device and the server. Check that your device clock is set to automatic and retry.
When to Use a 2FA Code Tester
Integrating 2FA Into Your Application
Troubleshooting Authentication Failures
Migrating Authenticator Apps
Security Audits and Compliance
Why Test 2FA Codes?
Two-factor authentication (2FA) is one of the most effective defenses against unauthorized account access. The TOTP standard, defined in RFC 6238, generates a new six-digit code every 30 seconds using a shared secret key and the current Unix timestamp. Our 2FA Code Tester lets you generate, compare, and verify these codes entirely in your browser with zero data sent to any server. Whether you are a developer integrating TOTP into a login flow or an end user debugging a rejected code, this tool gives you instant answers. Pair it with our Password Generator to build a complete credential security workflow.
Rejected TOTP codes are almost always caused by time synchronization problems or incorrectly encoded secret keys. This tester removes the guesswork by showing you exactly what code your secret should produce at the current moment. If the code in your authenticator app does not match, you know the issue is on the app side. If it does match but the server still rejects it, the problem lies in the server's verification window or clock. For deeper token inspection, try our JWT Decoder to analyze authentication tokens returned after successful 2FA login.
Beyond troubleshooting, the 2FA Code Tester is invaluable during development and QA. You can generate sample secrets, verify codes against known test vectors, and confirm that your implementation handles edge cases like clock drift and adjacent time-step acceptance. When combined with our HMAC Generator and Hash Comparison Tool, you have a complete suite for validating the cryptographic primitives that underpin TOTP authentication.
How It Compares
Several online TOTP testers exist, but most require you to paste your secret key into a form that sends it to a remote server for processing. This creates a serious security risk: if the server is compromised or logs requests, your 2FA secret is exposed and an attacker can generate valid codes for your account. The FindUtils 2FA Code Tester runs all cryptographic operations client-side using JavaScript. Your secret key never leaves your browser, making it safe to test even production secrets.
Compared to desktop authenticator applications, this tool has a distinct advantage for debugging: it shows you both the expected code and a live countdown, so you can visually confirm synchronization. Desktop apps like Google Authenticator display only the current code without revealing the underlying secret or timing details. For developers, the ability to paste any base32 secret and instantly see the resulting code stream is far faster than manually adding and removing test accounts in a mobile app.