How It Works
Time-based One-Time Password (TOTP) algorithms generate temporary security codes synchronized between an authentication server and your local device. The entire mathematical flow follows a strict cryptographic sequence:
Cryptographic Pipeline:
Secret Key + Current Unix Time → HMAC-SHA1 → Dynamic Truncation → 6-Digit OTP
The secret key is decoded from Base32 into raw binary bytes. The current Unix epoch timestamp is divided by 30 to create an 8-byte time-counter. An HMAC hash is generated, dynamically truncated, and formatted into the familiar 6-digit verification code.
Security & Privacy Guarantee
Zero Server Uploads
All HMAC-SHA1 calculations run exclusively in your browser memory via the native Web Crypto API.
No Storage or Cookies
Secret keys are never saved in cookies, localStorage, sessionStorage, or browser caches.
No Tracking Code
This tool contains zero third-party tracking scripts, analytics beacons, or remote logging.
RFC 6238 Official Test Vectors
Our mathematical implementation has been verified against the official IETF RFC 6238 test vectors using the standard ASCII secret 12345678901234567890 (Base32: GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ):
| Unix Timestamp (Seconds) |
Time Step Counter |
Algorithm |
Expected OTP |
Status |
| 59 |
1 |
SHA-1 (30s) |
287082 |
Passed |
| 1111111109 |
37037036 |
SHA-1 (30s) |
081804 |
Passed |
| 1234567890 |
41152263 |
SHA-1 (30s) |
005924 |
Passed |
| 2000000000 |
66666666 |
SHA-1 (30s) |
279037 |
Passed |
Frequently Asked Questions (FAQ)
1. What is TOTP?
+
TOTP stands for Time-based One-Time Password. It is a standardized algorithm (defined in RFC 6238) that calculates a temporary one-time password using a shared secret key and the current time.
2. How does this tool generate OTP?
+
This tool uses your browser's native Web Crypto API. It decodes your Base32 secret key, hashes it with the current 30-second time-counter using HMAC-SHA1, and extracts a 6-digit number.
3. Is my Secret Key sent to a server?
+
No, never. All calculations happen 100% locally inside your browser. Your secret key is never transmitted across the network, stored in cookies, or sent to any server.
4. Why does the OTP change every 30 seconds?
+
The 30-second validity window is defined by the RFC 6238 standard to protect against replay attacks. Even if an attacker intercepts your OTP, it expires permanently within seconds.
5. What should I do if my OTP is invalid?
+
First, check that your computer's system clock is synchronized to internet time. Even a 30-second clock drift will cause an invalid code. Second, verify that your Base32 secret key does not have missing characters.
