Quick guide and practical context
Generate authenticator codes for test workflows
This tool reads an authenticator setup QR code, a Base32 secret, or the otpauth:// link used by compatible TOTP apps. Once loaded, the temporary code is calculated directly in your browser and refreshes on the interval set by the service, usually every 30 seconds.
You can upload a QR screenshot, use the camera, or paste the secret manually. That is useful when validating OAuth, login, staging, or local environments without repeatedly enrolling the same test secret in a phone app. A standalone six-digit token cannot generate future codes: the QR, Base32 secret, or otpauth link is required.
Use a QR Code, Base32 secret, or otpauth link
Most setup QR codes contain an otpauth://totp/ link with the account name, issuer, algorithm, number of digits, and expiry period. The tool respects those parameters and supports SHA-1, SHA-256, and SHA-512 when they are included.
If you only have the secret, paste the Base32 value, normally letters A–Z and digits 2–7. Spaces and hyphens are accepted for easier copying. Passwords, recovery codes, and the currently visible one-time token are intentionally not interpreted as TOTP secrets.
- Upload an image that contains the setup QR Code.
- Scan the QR Code with camera permission in your browser.
- Paste a Base32 secret or an otpauth://totp/ link.
- Click the displayed code to copy it to the clipboard.
What the expiry counter means
TOTP is a time-based one-time password. The same secret creates a different value on every period, and the counter shows how long remains before the next rotation. Copy a value before it expires; if a service rejects it, wait for the next rotation or check that your device clock is accurate.
Most services use six digits and 30-second periods. Some QR codes use eight digits, another algorithm, or a different period. Showing those settings helps debug an unexpected test failure without guessing which part of the configuration differs.
Local saving is for QA, not critical accounts
When you choose to save an entry, its secret stays only in this browser’s localStorage and is used to build your local testing list. The QR code, secret, and temporary code are not sent to this tool’s server by default. LocalStorage can still be accessible to people with access to the browser profile, malicious extensions, or device backups.
Use saving for disposable accounts, development, staging, and manual QA. For personal, financial, administrative, or production accounts, use a trusted mobile authenticator, a password manager with TOTP, or a security key. Remove saved entries after testing, especially on shared computers.
Security limits and good practices
This tool works with time-based TOTP codes. It does not replace push confirmation, SMS, FIDO2/WebAuthn security keys, or recovery codes. Other QR formats cannot be turned into a valid second factor unless they contain compatible TOTP setup data.
Never share the secret key, enrollment QR, or screenshots of that setup. Anyone who has the secret can generate the same temporary codes while it remains active. After a test, revoke or rotate the secret in the issuing service if it was used outside an isolated environment.
