TOTP and HOTP Generator - SimeonOnSecurity
NOTE: This tool runs entirely in your browser with client-side JavaScript. Your secret is decoded and used to compute codes locally, and it is never transmitted, logged, or stored. That matters here more than anywhere else on this site, because a TOTP secret is the second factor itself.
Do not paste a production second factor secret into any page you do not control. This page is a single static file you can read in full, which is why it is safe to use here and unsafe on an unknown site.
Current Code
------
Verify a Code
What This Does and Does Not Prove
- TOTP is time based. The code is an HMAC over the number of elapsed periods, truncated to the requested number of digits.
- Your clock matters. If the server and this tool disagree by more than one period, codes will look valid here and fail there.
- Verifying here only checks arithmetic. A match proves the secret and clock agree with this page, not that the account is secure or that the server accepts it.
- A leaked secret defeats the second factor. Anyone who reads a TOTP secret can generate every future code, which is why it should never be typed into an untrusted site.
Sponsored by The Cyber Sentinels Club
