The shared TOTP authenticator built for dev and QA teams
Add your TOTP entries once. Every team member gets live codes — directly in the browser. No phones passed around. No one waiting on a teammate. No personal device dependency.
Follows Google Authenticator standards · RFC 6238 · Works with any TOTP-enabled service or app
Testing 2FA flows with a real phone was never a good idea
Personal Device Dependency
Your 2FA test flow is tied to someone's personal phone. That's not a test environment — that's a personal device standing in for one.
The Missing Piece
Your email, SMS, and webhook testing is already sorted. But every time someone needs a TOTP code, the team is back to passing a phone around. One tool should handle all four.
Single Point of Failure
The person with the authenticator app is offline. Testing stops. Everyone waits. For a tool that generates a six-digit number.
Shared Phone
Two QA testers. One team phone. One TOTP code every 30 seconds. One of them is always a step behind, waiting for the next window.
TOTP Inbox puts every code in the browser, visible to your whole team, the moment they need it.
WHAT IS TOTP INBOX
A shared authenticator app — built for teams, not individuals
Every authenticator app in existence — Google Authenticator, Authy, Microsoft Authenticator — was built for one person on one device. That works fine for personal accounts. It breaks the moment a QA team needs to share access.
Zunoy TOTP Inbox is a web-based authenticator for dev and QA teams. Add your TOTP entries once — by uploading a QR code or pasting a secret key. Every team member opens the browser and sees live codes for every entry, updating every 30 seconds, exactly like a real authenticator app.
No phones. No apps. No waiting on a teammate. The whole team, the same codes, in the same place.
Up and running in three steps
Add a TOTP Entry
Upload a QR code or paste your secret key directly. Add the issuer name and username to keep entries organised. Takes under 30 seconds per entry.
Live Codes appear Instantly
Your TOTP code is generated immediately — updating every 30 seconds with a countdown timer, just like a real authenticator app. No configuration needed beyond the secret.
Your whole Team sees it
Every team member with access opens TOTP Inbox and sees all entries and live codes simultaneously. Copy a code with one click. No sharing. No waiting. No phones involved.
THE EXPERIENCE
Same experience as your authenticator app. Minus the phone. Plus the whole team.
Live codes, timers, one-click copy — designed to feel familiar. Shared team access — the part no authenticator app ever offered.
Live Codes Per Entry
Every TOTP entry shows its current code, updating automatically every 30 seconds. The countdown timer shows exactly how long the current code is valid — no guessing, no expired codes mid-login.
One-Click Copy
Copy any code instantly with a single click. No typing. No transcribing from a phone screen across a desk. Paste directly into your login form and move on.
Add via QR Code
Upload the QR code from your service's 2FA setup screen. Sandbox reads the secret and registers the entry immediately — same flow as any authenticator app, done once for the whole team.
Add via Secret Key
Prefer to paste directly? Enter the secret key along with the issuer name and username. Same result, different input method. Whichever your service provides.
All Entries in One View
Every TOTP entry your team has added is listed in a single view. Labelled by issuer and username. No scrolling through a personal app to find the right account.
Role-Based Management
Team members view and copy codes based on their role. Adding, editing, and deleting entries is controlled by role permissions — not everyone needs write access, and that's intentional.
SECURITY
Shared access. Not shared risk.
TOTP Inbox is built for staging and test environments. Every security decision starts from that principle.
Never Store Production Secrets
TOTP Inbox is designed for test environments only. Use dedicated test TOTP secrets — never your production 2FA seeds. Your production accounts stay on personal devices where they belong. We mean that seriously.
Encrypted at Rest
All TOTP secrets are encrypted using AES-256 before being stored. Your secrets are unreadable at the storage layer — even internally.
Role-Based Access
Not everyone needs full control. Admins decide who can view codes, who can add new entries, and who can edit or delete existing ones. Temporary team members get viewer-only access without touching your configuration.
Account Isolation
TOTP entries are scoped strictly to your Sandbox account. Entries from your account are never visible to any other account or team. Each account is a sealed environment.
Keep production 2FA on personal devices. Keep staging 2FA in TOTP Inbox. That's the boundary — and we help you respect it.
Ready to test safely? Start your
free sandbox in under 60 seconds.
One Single Tool for - Email + SMS + Webhook + TOTP
Maintain customer trust - Test Alerts before your Users do
Setup under 5 minutes
Real human support by Zunoy Team
One inbox. Every code. The whole team.
TOTP testing shouldn't depend on who's available, whose phone is charged, or who's in the right timezone.
Shared Access Across the Team
Every team member sees the same TOTP entries and live codes simultaneously. Your QA engineer and backend developer are looking at the same code at the same time — no coordination required.
No Phone. No App. No Dependency.
The entire setup lives in the browser. Nothing installed. Nothing tied to a personal device. New team member joins? They open the URL and they're in — based on their role.
Role-Based Permissions
Admins control who can add, edit, and delete TOTP entries. Testers and QA engineers get the access they need — view and copy — without the ability to modify the team's configuration.
As Many Entries as Your Plan Allows
Add TOTP entries for every test environment, every staging account, every service your team needs to access. Entry limits are based on your plan tier.
Google Authenticator is personal. TOTP Inbox is for teams.
The apps your team currently uses were built for individuals securing personal accounts — not for QA teams sharing test environment access across browsers and timezones.
| FEATURES | GOOGLE AUTHENTICATOR / AUTH |  ZUNOY TOTP INBOX |
|---|---|---|
Shareable across team | One device, one person | Whole team, any browser |
Browser-based | Mobile Only | No app install needed |
Team role management | View and manage by role | |
Multiple entries managed centrally | Per Device | One shared list |
No personal device needed | ||
Part of a full testing suite | Email + SMS + Webhook included |
For personal 2FA, use an authenticator app. For team testing, use TOTP Inbox.
What dev and QA teams actually use TOTP Inbox for
TOTP Inbox is one piece of a complete testing environment
Your app sends emails, SMS, webhooks, and TOTP codes. Sandbox handles all four — in one workspace, under one account, visible to your whole team.
Email Inbox
SMS Inbox
Webhook Inbox
TOTP Inbox
The things developers actually ask about TOTP Inbox
What is Zunoy TOTP Inbox?
A browser-based shared authenticator for development and QA teams. Add your TOTP entries — via QR code or secret key — and every team member accesses live codes from any browser. No phone, no app, no personal device required.
How is this different from Google Authenticator or Authy?
Google Authenticator and Authy are designed for individuals securing personal accounts on a mobile device. TOTP Inbox is designed for teams — shared access, browser-based, role-managed, and built specifically for staging and test environments.
Does it work with any TOTP-enabled service?
Yes. If a service supports TOTP-based 2FA and provides a QR code or secret key during setup, it works with TOTP Inbox. It follows the same RFC 6238 standard as Google Authenticator.
Is it secure? Who can see our TOTP codes?
Only team members with access to your Sandbox account can see your TOTP entries. All secrets are encrypted at rest using AES-256. TOTP Inbox is designed for test environments — we strongly recommend using dedicated test secrets, not production 2FA seeds.
Can I add a TOTP entry using a QR code?
Yes. Upload the QR code from your service's 2FA setup screen. Sandbox reads the embedded secret and registers the entry immediately.
Stop passing the phone around.
Add your first TOTP entry in under 30 seconds. Live codes in the browser, shared with your whole team, from the moment you're done.
Works with any TOTP-enabled service
Every team member gets live codes instantly
Role-based access from day one
Free forever on basic plan
Sandbox
Test Email, SMS, Webhooks & 2FA codes without touching production.
Operational
Contact Us On
Mail Us
support@zunoy.comCopyright © 2026 - Mentcube Innovations Pvt Ltd.. All Rights Reserved.