How It Works Under the Hood
Decodes Base32 (RFC 4648) secrets locally and signs the big-endian 64-bit Unix time counter using Web Crypto HMAC-SHA1/256/512 with RFC 4226 dynamic truncation across current, -1, and +1 clock steps.
Step-by-Step Instructions
Paste a Base32 2FA Secret Key, generate a test secret, or import an otpauth://totp URI.
Configure HMAC algorithm (SHA-1/256/512), 6/8 digits, and step period (default 30s).
Verify live OTP parity against your backend or scan the generated Authenticator QR.
Key Features & Performance
- Previous & Next Step Display: Quickly diagnose server/device clock skew issues
- Supports SHA-1, SHA-256 & SHA-512: Covers standard authenticator apps and enterprise TOTP specs
- otpauth:// URI Round-Trip: Import URIs cleanly or export scannable QR codes
- Zero Telemetry: Secrets remain strictly inside volatile browser RAM
Local Browser Processing & Privacy
Traditional web converters upload your documents, snippets, or media files to remote servers. Offline TOTP 2FA Debugger & QR Exporter runs inside your browser tab:
Your input text and files are processed locally without uploading payloads to a processing server.
Microdeck does not log or store the files or inputs you paste into tool workspaces (normal static hosting/CDN requests still load page assets).
Working outputs stay in your browser tab and are released when you reset the tool or close the tab.
Frequently Asked Questions
Why does my app fail verification even when the code looks right?
Server clock drift of 30+ seconds is the most common cause. Compare your app against the Previous (-1) and Next (+1) step codes shown below the active code.
Which HMAC hash do Google Authenticator and 1Password expect by default?
Almost all consumer authenticators default to SHA-1, 6 digits, and a 30-second period.
Explore Related Micro-Tools
Secure Offline Password & Hash Generator
Generate cryptographically secure passwords & WebCrypto hashes with zero server logs
SSL Certificate & CSR Decoder (PEM / DER)
Inspect X.509 .pem/.crt chains, SANs, expiry countdowns, CSRs & convert PEM ↔ DER
Permanent Static QR & Barcode Generator
Generate forever-free QR codes (URL, WiFi, vCard) & Barcodes (Code 128)