AltF Authenticator

What is TOTP?

TOTP, the time-based one-time password, is the method behind most authenticator apps. Your app and the service share a secret, and both combine it with the current time to make the same short code every 30 seconds. It is defined in RFC 6238, which builds on HOTP in RFC 4226.

  • Free, no sign-up
  • Secrets stay in your browser
  • RFC 6238 self-test built in
  • Works on mobile

How it works in plain English

  • When you turn on 2FA, the service creates a random secret and shows it as a QR code.
  • Your app saves the secret. The service keeps its own copy.
  • Every 30 seconds, both sides take the current time, divide it into a step number and mix it with the secret using HMAC.
  • The result is cut down to 6 digits. If your code matches the server's, you are in.

Why it needs no internet

The app never asks the server for a code. It only needs the secret and an accurate clock, so it works in airplane mode. That is also why a wrong clock is the most common reason codes fail.

What TOTP protects against

It stops someone who only has your password, for example from a data breach, from signing in. It is not phishing-resistant: a fake login page can ask for your code and use it straight away. Passkeys and hardware security keys are tied to the real website, so they resist that attack. TOTP is still much stronger than a password alone and generally stronger than SMS codes.

The pieces you might see

  • Secret: Base32 text such as JBSWY3DPEHPK3PXP.
  • otpauth:// link: the text inside the setup QR code.
  • Algorithm: SHA-1 by default; SHA-256 and SHA-512 are allowed.
  • Digits and period: 6 digits every 30 seconds by default.

Live 2FA codes

Add a secret, an otpauth:// link or a QR screenshot. Codes are calculated on this device with the Web Crypto API and refresh every period.

Spaces and lower case are fine. Base32 uses A-Z and 2-7.

Advanced: algorithm, digits, period

Leave the defaults unless the service says otherwise. An otpauth:// link sets these for you.

Accounts (0)

No accounts yet

Try the RFC demo secret to see how it works.

Secrets stay in this tab. No request made by this page contains a secret or a code, and nothing goes to analytics. Saving is optional and encrypted on this device; set a passphrase or wipe it in the 2FA Authenticator vault tool.

What is TOTP?: questions and answers

Is TOTP the same as Google Authenticator?

Google Authenticator is one app that uses TOTP. Microsoft Authenticator, Authy, 1Password, Bitwarden and many others use the same standard, so the same secret works in any of them.

Can someone guess a TOTP code?

A random 6-digit code has a one in a million chance per try. Services limit attempts, so guessing is not practical.

What happens if I lose the secret?

You cannot make codes any more. Use a backup code or the service's recovery process, then set up 2FA again.

Is TOTP better than SMS codes?

Usually yes. SMS codes can be stolen by SIM swap or interception, while TOTP codes are made on your device. Passkeys are stronger than both.

Start from what happened

Authenticator tools and 2FA guides

All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.TOTP code generatorGenerate TOTP 2FA codes from a Base32 secret, otpauth:// link or QR image. SHA-1, SHA-256 or SHA-512, 6 or 8 digits, calculated in your browser.otpauth QR code generatorBuild an otpauth:// URI with issuer, account, algorithm, digits and period, and draw the 2FA setup QR code in your browser. Free, nothing uploaded.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.HOTP generatorGenerate HOTP counter-based one-time passwords per RFC 4226 from a Base32 secret and any counter value. Includes the RFC test values. Runs in your browser.Google Authenticator export decoderDecode a Google Authenticator Export accounts QR (otpauth-migration://) into standard otpauth links and secrets, locally in your browser. Nothing uploaded.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.

Guides

Lost phone 2FA recoveryLost or reset the phone with your authenticator app? Steps to get back into accounts with backup codes or recovery, then set 2FA up safely again.SMS vs authenticator appSMS codes, authenticator apps, passkeys and security keys compared: what each protects against, the risks of SIM swap and phishing, and what to choose.

AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.