Otp Code Generator And Validator

Time-based One-Time Passwords (TOTP, RFC 6238) are the 6-digit codes shown by authenticator apps such as Google Authenticator, Microsoft Authenticator, Authy and 1Password. Both your server and the app share a secret, and each independently calculates the same code from the current time. This tool generates secrets and codes and validates codes, which is useful for building and debugging two-factor authentication.

How to use it

1. Generate a new Base32 secret or paste an existing one.
2. Scan the QR code with an authenticator app, or watch the current code here.
3. Enter a code to check whether it is valid for the current time window.

How TOTP works

1. Take the current Unix time and divide by the period, usually 30 seconds, to get a counter.
2. Compute HMAC-SHA1 of the counter using the shared secret.
3. Dynamically truncate the 20-byte result to a 31-bit number and take the last 6 digits.

Because both sides use the same secret and clock, they produce the same code without communicating.

The provisioning URI

Authenticator QR codes encode a URI like otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example&digits=6&period=30.

Implementation tips

• Allow small clock drift: accept the previous and next 30-second window.
• Prevent replay: reject a code that was already used in the same window.
• Rate-limit attempts: 6 digits means only a million possibilities.
• Store secrets encrypted and offer backup codes for lost devices.
• Server clocks must be synchronised with NTP.

Use a test secret here, never the secret protecting a real account.