TOTP Authenticator Code Generator

Generates the same six-digit codes an authenticator app would, so you can check a secret works before you rely on it. Everything stays in this tab — nothing is saved or sent anywhere.

Next and previous codes

Servers usually accept the neighbouring code too, to allow for clock drift.

Eight digits is a hundred times safer and a hundred times less uniform

A TOTP code is a 31-bit number — 2,147,483,648 possibilities — reduced with a modulo into a decimal range that does not divide it. The remainder has to go somewhere, so some codes come up more often than others.

Every code is accounted for and every one of the 2,147,483,648 outcomes lands somewhere — the two columns multiply out to exactly 2³¹. The bias gets ten times worse with each digit added, because the same 2³¹ is cut into ten times as many bins. At six digits it is 0.047%; at eight, some codes are 4.8% likelier than others. Going from six digits to eight multiplies the search space by 100 and the bias by about 102 — the same factor, pulling opposite ways. It is not a practical weakness, since an attacker who knew which codes were favoured would still be searching 100,000,000 of them. It is a real property of the standard, and it runs against the intuition that more digits is uniformly better. No digit count divides 2³¹ evenly, so there is no setting that removes it.

The 30-second code is valid for 90

Clocks drift, so nearly every verifier accepts the previous and next steps as well as the current one — which is exactly why this page shows you 3 codes rather than one. The consequence is that a 30-second code has a 90-second life, and the target an attacker is shooting at is 3 times the width of the progress bar above. Each further step of tolerance a server allows adds two more valid codes, not one.

With a million six-digit codes an attacker averages 500,000 attempts. Which is the whole argument in one line: the digits are not the defence, the rate limit is. Six digits at three attempts a minute holds for 116 days; eight digits with no limit at all falls in 5.8 days. The rate limit is worth about 20 times what the two extra digits are.

That 5.8 days is the same figure as the first row of the table, and not by accident: a hundred times as many codes attacked a hundred times as fast takes exactly as long. Two extra digits buy you nothing at all against an attacker who is merely allowed to try harder.

A Base32 secret is not always a whole number of bytes

Base32 carries five bits per character and a key is made of whole bytes, so a secret only converts cleanly when its length is a multiple of eight characters.

The usual 16-character secret is 80 bits, exactly 10 bytes, and the longer 32-character one is 160 bits. Both are clean. Anything else leaves a few bits stranded at the end. A one-character secret is five bits, which is no bytes at all — so the browser's crypto refuses it outright with "Zero-length key is not supported". That message is perfectly true and explains nothing to somebody who has typed a single letter into a box, so: 2 characters is the shortest secret that produces any key material, and 16 is the shortest anyone should use.