PocketPlay
中文

TOTP Authenticator

Turn a two-factor secret or otpauth QR code into live 6-digit TOTP codes, and create new secrets with their QR — offline in your browser.

🔒 Runs in your browser — files never leave your deviceFree · No sign-up

Everything here runs in your browser. Your secret is never sent anywhere, never stored and disappears when you close the tab — but for the same reason, this page is a testing and recovery tool, not a replacement for a real authenticator app.

Secret

Paste the key a site shows next to its QR code, or the whole otpauth:// link — the options below fill in automatically.

Current code

— — —
Counter
—
Valid until
—
otpauth URI
—

Create a new secret

How to get a TOTP code

  1. Paste the Base32 secret from your account's two-factor setup page, or the whole otpauth:// link. If you only have the QR image, press Read a QR image and pick the screenshot.
  2. The six-digit code appears immediately and the ring counts down the seconds until it changes.
  3. To set up a new account, press Generate secret, show the QR code and scan it with your authenticator app — then store the Base32 string somewhere safe as a backup.

FAQ

Is it safe to paste my secret here?

The calculation happens entirely in your browser with the Web Crypto API — no network request is made and nothing is saved, so closing the tab erases it. That said, a TOTP secret is a long-lived credential: only paste one you are testing, recovering, or have just created yourself.

Why does the code not match my app?

Almost always a clock problem: TOTP depends on your device's time, so a phone or computer that is more than about 30 seconds off produces a different code. Check that automatic time sync is on, and that the digits, period and algorithm match what the server expects.

What do the options mean?

Six digits, a 30-second period and SHA-1 is what almost every service uses, including Google, GitHub and AWS. Some banking apps use 8 digits, 60 seconds or SHA-256 — the otpauth:// link says which, and pasting it sets all three for you.

Hash GeneratorHOT Generate MD5, SHA-1, SHA-256, SHA-512, SHA-3, RIPEMD-160 and CRC32 hashes of text or files, with HMAC support. Password GeneratorHOT Generate strong random passwords, pronounceable passwords and Diceware passphrases, with an entropy and crack-time estimate. Text Encryption Encrypt and decrypt text with AES-256-GCM and a password, entirely in your browser — plus classic Caesar, Vigenère and Atbash ciphers. RSA Key Generator Generate RSA, ECDSA or Ed25519 key pairs in your browser, export them as PEM or JWK, and try encryption and signing with them. Bcrypt Hash Generate and verify bcrypt password hashes in your browser, with Argon2id and PBKDF2 as alternatives. File Encryption Encrypt any file with a password using AES-256-GCM, and decrypt .enc files back to the original name — all inside your browser. ZIP Manager Create ZIP archives from files or a whole folder, and open an existing ZIP to browse, preview, extract, add or delete files — all offline. File Checksum Verifier Check a downloaded file against its published MD5, SHA-1 or SHA-256 checksum, and hash many files at once with a CSV export.

All tools →