Agent X Alpha

TOTP / 2FA Authenticator Simulator

Client-SideOffline Ready

Simulate, generate, and verify RFC 6238 Time-based One-Time Passwords with interactive countdowns, URI import, and clock drift testing.

UTC: 16:17:32 | Step: #59773475

Configured Accounts (3)

GitHubSHA-1

[email protected]

--- ---
AWS IAMSHA-1

admin-root-user

--- ---
GoogleSHA-1

[email protected]

--- ---
Active Simulation

GitHub

[email protected]

28s

Current One-Time Password

------
Period: 30s•Digits: 6•Algorithm: SHA-1
Shared Secret (Base32):

JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP

Standard RFC 6238 Algorithm

100% In-Browser Privacy

Cryptographic HMAC-SHA calculations run strictly in your browser using the W3C Web Crypto API. No secrets, tokens, or OTP codes are ever sent to any server.

RFC 6238 & RFC 4226 Compliant

Full fidelity simulation matching Google Authenticator, Authy, 1Password, and Microsoft Authenticator with SHA-1, SHA-256, and SHA-512 algorithm support.

Clock Drift & Token Verification

Test your backend 2FA implementation with built-in code verification and ±1 or ±2 time step drift tolerance simulation.

Frequently Asked Questions

How does Time-Based One-Time Password (TOTP) work?
TOTP (RFC 6238) computes an HMAC hash using a shared secret key and the current Unix epoch timestamp divided by a time step (usually 30 seconds). The resulting HMAC digest is dynamically truncated into a 6 or 8-digit numerical token that rotates automatically.
Can I import an otpauth:// URI or QR code secret?
Yes. You can paste a standard otpauth://totp/ URI (e.g. otpauth://totp/GitHub:alice?secret=JBSWY3DPEHPK3PXP&issuer=GitHub) directly into the secret or URI field, and the tool will automatically extract the secret, issuer, account name, algorithm, and period.
What is clock drift and why does it matter?
Because client and server system clocks can differ by a few seconds, standard authenticators and backends check the current 30-second window plus or minus one step (±30s). The verify tab lets you test code validity across drift windows.
Are my 2FA secrets safe in this tool?
Yes. Everything runs completely client-side. We do not store your secrets in cookies or remote databases, and you can clear active accounts at any time.
Recommended For You

More Security & Privacy Utilities

View all Security & Privacy tools
Security & Privacy

DMARC, SPF & DKIM Email Security Auditor & Generator

Audit live DMARC, SPF, DKIM, and BIMI DNS records. Detect 10-lookup SPF limit violations, spoofing vulnerabilities, and generate copy-paste DNS records and 2048-bit DKIM keys.

Network APILaunch
Security & Privacy

PII & Secret Log Redactor / Masker

Scrub credentials, API keys, passwords, credit cards, emails, and PII from production logs and error stack traces 100% locally in your browser before sharing.

Client-SideLaunch
Security & Privacy

CSP Generator

Build Content Security Policy headers visually with toggleable directives and sources.

Client-SideLaunch