Cipher turns a two-factor secret into the live 6-digit code — the same rolling number an authenticator app shows — so you can check that a secret is set up correctly. Paste the Base32 secret (or an otpauth:// link) and watch the code tick. Everything happens on your device and no secret is ever sent or stored.

Secret (Base32) or otpauth:// link

Digits

Period (s)

Algorithm

— — —

–

the code refreshes automatically

This generates time-based one-time passwords (TOTP, RFC 6238) with the Web Crypto HMAC, the same standard Google Authenticator and others use. It is a checker, not a vault — nothing is saved, so the secret is gone when you leave the page. Never paste a secret you don't own or on a device you don't trust. Everything runs on your device.