Earlier I wrote: > $md5 = getOTP64(md5("$i$otphash"),TRUE); Oops, of course I meant: $md5 = getOTP64(md5("$i$otphash",TRUE)); Might as well pass "$i$otphash" directly to getOTP64 and let encode() do md5().