双因素认证验证码生成器

How two-factor codes work

Your authenticator app and the website both hold the same shared secret. Every 30 seconds both compute a code from that secret and the current time. Entering the code proves you hold the secret without sending it.

This is TOTP (Time-based One-Time Password), defined in RFC 6238. The older HOTP (RFC 4226) counts up instead.

The maths

1. Take the current time, divided by 30 seconds. That is the counter.
2. Run the counter through HMAC-SHA-1 using your secret as the key.
3. Take the last 4 bits of the result to find an offset into the digest.
4. Read 4 bytes from that offset, drop the top bit, and take the result modulo 1,000,000.
5. Pad to 6 digits and format as 123 456.

TOTP = HMAC-SHA-1(secret, floor(unix_time / 30))

Getting your secret

When you enable 2FA on a site, it shows a base32 string, either as text to copy or as a QR code to scan. That string is what you paste here.

The standard secret is JBSWY3DPEHPK3PXP, which is the base32 encoding of the bytes Hello! followed by the DEADBEEF test vector. If a site shows you that value, it is almost certainly a demo.

Security warning

Do not paste a production secret into any website, including this one. This tool happens to compute everything locally with no network request, but the only way to be certain of that is to read the source. The source for every tool here is in the content/tools/ directory of the site repository.

If you want to be certain, run it locally:

git clone <the-repo>
npm run build && npm run serve

Then open it at localhost and paste the secret there. Nothing can leave your machine.

Why time matters

The counter is floor(unix_time / 30), so the code is valid for the current 30-second window. Servers usually accept the previous and next window too, to tolerate clock drift. If codes are rejected consistently, check that your device clock is accurate — that is the usual cause.

Recovery codes

Sites also give you recovery codes, which are single-use passwords for when you lose your device. They are shown once, so store them somewhere safe and separate from your authenticator. Treat them like passwords.