The way the algorithm works is by dividing the current Unix time by the time step (commonly 30 seconds), and generating an HMAC from that. That's why most codes expire twice every minute at :00 and :30. However, to avoid clock synchronization issues, most websites will allow the codes from one or two time windows in the past or future.

This tool takes in the base32 secret and generates a bunch of OTPs, past, present, and future to help test those corner cases. By default, it uses the settings that most websites use: SHA-1, 6 digits, 30 second time steps, but those could be changed in the advanced settings.

Another use is when testing 2FA enablement repeated or creating throwaway testing accounts on apps that require 2FA setup, but you don't want to pollute your authenticator app with all the test accounts. You can just paste the secret into this tool and get the codes immediately.

You can also use this as a crude "authenticator app" since the secret is stored in the URL hash and you can bookmark that. This is probably more suitable for scripts that create test accounts with 2FA than a long term solution for your important accounts.

While it's a bit niche, I built this tool to address the pain points I ran into when testing TOTP, and I hope you'll also find it useful or fun to play around with. You can enter any random base32 string to see it in action. I find it quite fun to reduce the time step to 1 or 2 seconds and watch the codes scroll by with that overengineered animation...

This is a simple frontend JavaScript app and the source code is available at https://github.com/quantum5/totp.