This browser-based tool calculates HMAC-based one-time passwords from a shared secret and counter. Use it to compare token and server values, inspect moving-factor windows, test code lengths, and troubleshoot SHA algorithm settings.
Secrets and generated codes stay in the current browser session and are not uploaded by this page. For interoperable deployments, compare your settings with RFC 4226. For time-based tokens, use the TOTP generator.