Standard RFC 6238 test vectors
The table on this page lists the public RFC 6238 Appendix B expected 8-digit TOTP outputs for fixed Unix timestamps. Use it to check SHA-1, SHA-256, and SHA-512 implementations without using a real 2FA account.
TOTP test vectors and demo token
This guide combines public RFC 6238 TOTP test vectors with a simple demo secret so you can test an authenticator app, local 2FA generator, or TOTP library before using a real account setup key. It helps diagnose mismatched algorithm, digit count, period, clock, and otpauth settings.
How to use the vector table
Set your TOTP implementation to the RFC test secret for the selected hash algorithm, 8 digits, and a 30-second period, then compare the generated value at each listed Unix timestamp with the expected output.
Public demo setup key
For a non-sensitive test, use the public Base32 setup key JBSWY3DPEHPK3PXP with SHA-1, 6 digits, and a 30-second period. This key is only for testing behavior, not for protecting an account.
otpauth test URI
The matching otpauth URI is otpauth://totp/2FA%20Test:test-token?secret=JBSWY3DPEHPK3PXP&issuer=2FA%20Test&algorithm=SHA1&digits=6&period=30. A compatible app should produce the same current code when the device time matches.
How to compare generated codes
Paste the demo key into this local generator and add the same key to your authenticator app as a manual setup key. Compare the current six-digit code during the same 30-second window.
If the test code differs
Check the device clock, time zone, algorithm, digit count, period, and whether the app stored the same Base32 secret. Most mismatches come from time drift or a copied character that differs from the original setup key.
Safe testing boundary
Do not publish or share real 2FA setup keys. When testing a real account, prefer the #secret= fragment shortcut because fragments stay in the browser and are not sent in the HTTP request.
What this test cannot verify
A local token test can confirm TOTP calculation compatibility, but it cannot prove that a specific account accepts the code, recover lost 2FA, approve push login prompts, or generate SMS, email, passkey, or recovery codes.
RFC 6238 TOTP test vectors
These public RFC 6238 Appendix B vectors use 8-digit TOTP values for SHA-1, SHA-256, and SHA-512. They are useful for checking whether a TOTP generator, authenticator app, or library matches the standard algorithm.
| Unix time | UTC time | SHA-1 expected TOTP | SHA-256 expected TOTP | SHA-512 expected TOTP |
|---|---|---|---|---|
59 | 1970-01-01 00:00:59 UTC | 94287082 | 46119246 | 90693936 |
1111111109 | 2005-03-18 01:58:29 UTC | 07081804 | 68084774 | 25091201 |
1111111111 | 2005-03-18 01:58:31 UTC | 14050471 | 67062674 | 99943326 |
1234567890 | 2009-02-13 23:31:30 UTC | 89005924 | 91819424 | 93441116 |
2000000000 | 2033-05-18 03:33:20 UTC | 69279037 | 90698825 | 38618901 |
20000000000 | 2603-10-11 11:33:20 UTC | 65353130 | 77737706 | 47863826 |
RFC 6238 TOTP test vectors (JSON)
Standards and references
FAQ
What are TOTP test vectors?
TOTP test vectors are known inputs and expected outputs used to verify an implementation. The RFC 6238 vectors fix the timestamp, hash algorithm, digit count, and secret so another implementation can be compared exactly.
Can I use the demo TOTP secret on a real account?
No. The demo secret is public and should never protect a real account. It is only useful for checking whether two TOTP generators calculate the same code.
Why do two test tokens show different codes?
The most common causes are device clock drift, a different period, a different digit count, a different algorithm, or a copied secret that is not exactly the same after normalization.
Can this page scan a QR code?
No. This tool focuses on pasted Base32 setup keys and otpauth://totp/ links. If your account only shows a QR code, use the manual setup key if the service provides one.
Is the test generated locally?
Yes. The TOTP code calculation runs in the browser. For real secrets, avoid path and query URLs and use a fragment shortcut such as #secret=YOUR_BASE32_SECRET.