TOTP 2FA Token Generator & Verifier
TOTP 2FA Token Generator & Verifier: Computes time counter T = floor(timestamp / 30), generates HMAC-SHA1 digest, and extracts 6-digit dynamic truncation code.
About this totp 2fa token generator & verifier
TOTP 2FA Token Generator & Verifier — browser-based utility.
How this tool works
Implements IETF RFC 6238 Time-Based One-Time Password algorithm by deriving a counter value $C = \lfloor(T - T_0) / X floor$ from Unix time, computing HMAC-SHA-1/256/512 over the 8-byte big-endian counter, extracting a dynamic 4-byte truncated binary code via offset masking, and taking modulo $10^d$. Supports bidirectional code generation and token verification against allowable drift windows.
- Token Structure Extraction: Splits JWT strings on '.' delimiters into Header, Payload, and Signature segments.
- Base64URL Decoding: Decodes URL-safe Base64 segments into raw JSON strings without executing unverified signature payloads.
- Claims Parsing & Timestamp Evaluation: Parses registered claims ('exp', 'nbf', 'iat', 'iss', 'aud') and checks current clock validity.
- Cryptographic Status Reporting: Displays token signature algorithm (RS256, HS256, ES256, EdDSA) and warns that client decoding does not verify cryptographic signatures without the public key.
Worked example
Scenario: A user verifies a 2FA authentication token using a secret key according to RFC 6238.
Sample input:
Processing: Computes time counter T = floor(timestamp / 30), generates HMAC-SHA1 digest, and extracts 6-digit dynamic truncation code.
Illustrative output:
Limits and verification
Rejects strings that do not contain exactly two '.' delimiters. Explicitly informs the user that client-side decoding inspects token claims but CANNOT verify mathematical signature validity unless the corresponding public key/secret is supplied.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the TOTP 2FA Token Generator & Verifier workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
How does TOTP Generator derive its counter?+
It reads JSON secret, period, timestamp, digits, and algorithm, converts timestamp to seconds under its documented millisecond rules, then uses floor(seconds divided by period).
What did the browser fixture verify?+
RFC 6238 secret at timestamp 59, period 30, eight digits, and SHA-1 produced TOTP 94287082.
How does token verification tolerate clock drift?+
When a token is supplied, it compares the current code plus one previous and one next time-step. A valid result is not proof that system clocks are synchronized exactly.
Can it use any arbitrary secret text?+
The HMAC helper expects the supported secret encoding used by the tool. Interoperability requires matching secret encoding, algorithm, period, digits, and timestamp units.