TOTP Validator
Check whether a TOTP code is valid for a Base32 secret at the current or a given time, with an adjustable ±steps window like real 2FA servers use.
The key shown by the service when you set up 2FA. Spaces and lowercase are fine.
±steps around the current one; 1 = ±30 s with the default period.
Leave empty to use the current time.
Checks the current step first, then earlier and later steps up to the allowed drift, as servers do. A real server must also reject a code that was already used.
Runs entirely in your browser. Your data is never uploaded.
What is TOTP Validator?
Enter a secret and a code to check whether the code is valid now, or at a time you specify, allowing the same clock-drift window that authentication servers use. The result tells you which time step matched, which helps diagnose clock problems.
How to use TOTP Validator
- Paste the Secret key (Base32).
- Enter the Code to check.
- Set Algorithm, Digits, Period and Allowed drift (steps); optionally a Unix time.
- Click Validate and read the result.
Example
Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, 8 digits, Unix time 89, code 94287082, drift 1
Valid: the code matches time step -1 (clock drift).
When to use TOTP Validator
Use it to debug 2FA logins that fail, test the drift window of your implementation or check codes from hardware tokens. A real server must additionally reject codes that were already used once.
How TOTP Validator works
The current step T = floor(time / period) is checked first, then T−1, T+1, T−2 … up to the allowed drift. Each step's code is computed with HMAC per RFC 4226/6238 and compared with the entered code. A match reports its offset, for example −1 if the code came from the previous 30-second window.
Common Use Cases
- Diagnosing failed 2FA logins caused by clock drift
- Testing a TOTP implementation's acceptance window
- Verifying codes from a hardware token
- Teaching how TOTP validation works
FAQs
What drift window should a server allow?
RFC 6238 recommends at most one step back for network delay; many servers accept ±1 step (±30 seconds).
Why is a valid code rejected after login?
Servers must remember used codes and reject them again to prevent replay attacks.
Can I validate HOTP codes here?
No, use the HOTP generator and compare codes for the counter values you expect.