Upcoming 30s Time Windows Scan with Authenticator App

Open Google Authenticator, Authy, or 1Password to scan this QR code.

Is my 2FA secret key stored or sent to your server?

No. NexTools executes 100% of the HMAC hashing and Base32 decoding inside your browser using the native Web Cryptography API. Your secret key never leaves your local device.

Can I use this tool to verify Google Authenticator or Authy secrets?

Yes. Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, and Authy all adhere to standard RFC 6238 TOTP with 6 digits and a 30-second refresh period. The code generated here will match your mobile authenticator app exactly when your system clock is synchronized.

What format should the 2FA secret key be in?

TOTP secret keys are typically represented as Base32 encoded strings consisting of characters A-Z and digits 2-7 (e.g. JBSWY3DPEHPK3PXP). Spaces and dashes are automatically stripped.

TOTP 2FA Authenticator Code Generator

Generate real-time RFC 6238 two-factor authentication codes from Base32 secrets. Live 30s countdown, secret tester, and QR code generator with 100% in-browser WebCrypto.

Authenticator Secret Key Settings

Base32 Secret Key

Characters A-Z, 2-7. Spaces and dashes are automatically removed.

Account Label / Email

Issuer / Service Name

Digits

Period (Step)

Algorithm

otpauth:// URI (for Authenticator Import)

Live Sync

Current 2FA Token

000 000

Expires in 30s

Upcoming 30s Time Windows

What is TOTP (RFC 6238) Two-Factor Authentication?

Time-Based One-Time Password (TOTP) is an open authentication algorithm standardized by the Internet Engineering Task Force (IETF) in RFC 6238. It generates temporary, short-lived security tokens (usually 6 digits) calculated from a shared symmetric secret key and the current Unix epoch time in seconds.

Because both the user device and authentication server maintain synchronized real-time clocks, they calculate identical codes during each 30-second window without needing an active internet connection or SMS gateway, rendering TOTP immune to SIM-swapping and SMS interception attacks.

Key Capabilities

RFC 6238 Compliance: Native support for HMAC-SHA1, HMAC-SHA256, and HMAC-SHA512.
Visual 30s Countdown: Live real-time synchronized progress bar and second counter.
QR Code Generator: Produces standards-compliant otpauth:// QR codes instantly.
Secret Key Testing: Easily verify and debug secret keys from backend implementations.
100% Client-Side Privacy: Uses browser Web Cryptography API; zero server requests.

How It Works Step-by-Step

Base32 Decoding: Converts the Base32 secret into raw cryptographic key bytes.
Time Counter: Calculates time interval step: $T = \lfloor \text{Epoch Seconds} / 30 \rfloor$.
HMAC Calculation: Hashes the 8-byte big-endian time counter with the secret key using WebCrypto HMAC.
Dynamic Truncation: Extracts a 4-byte dynamic slice based on the last 4 bits of the digest.
Modulo Reduction: Calculates $\text{code} = \text{slice} \bmod 10^6$ to output the 6-digit passcode.

Frequently Asked Questions

Why does my generated code differ from my phone?

Check that your computer's clock and your phone's clock are synchronized with an automated network time server (NTP). A discrepancy of even 15–30 seconds can shift the active time step window.

Is it safe to paste real 2FA secrets into this tool?

Yes, NexTools runs completely client-side in your local browser sandbox. However, for maximum operational security, we recommend using this tool to test, debug, and verify 2FA implementations, or using test credentials.

What is the difference between TOTP and HOTP?

HOTP (RFC 4226) uses an incremental counter that increments with each button press or login attempt. TOTP (RFC 6238) replaces the manual counter with the current timestamp divided by 30 seconds, enabling automated time-based expiration.