TOTP 2FA Token Generator & Verifier
TOTP 2FA Token Generator & Verifier: Computes time counter T = floor(timestamp / 30), generates HMAC-SHA1 digest, and extracts 6-digit dynamic truncation code.
About this totp 2fa token generator & verifier
Computes time counter T = floor(timestamp / 30), generates HMAC-SHA1 digest, and extracts 6-digit dynamic truncation code Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Derives a time counter by dividing Unix seconds by the selected period and flooring the result, then generates a 6–8 digit TOTP code with HMAC-SHA-1, SHA-256, or SHA-512. When a token is supplied, it checks the current counter and one adjacent step on each side. This local page does not authenticate a user or keep a secret.
Worked verification example
Scenario: Generate a deterministic six-digit TOTP from a Base32 secret at a supplied Unix-seconds timestamp.
Sample input:
Processing: Treat this ten-digit timestamp as Unix seconds, compute counter floor(1700000000/30), then HMAC-SHA-1 and dynamic truncation.
Illustrative output:
Security parameters & input constraints
Period must be a positive safe integer, timestamp non-negative safe integer, digits 6–8 and algorithm SHA-1, SHA-256 or SHA-512. Base32 decoding occurs only for matching secret alphabet and length; other text is UTF-8. Verification accepts a ±1-step window and the JSON exposes the generated code; this is a local algorithm aid, not an authentication service.
Cryptographic digests, encoded strings, and signatures generated by TOTP 2FA Token Generator & Verifier should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in TOTP 2FA Token Generator & Verifier execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
TOTP 2FA Token Generator & Verifier verification · Audit standards
How to use it
- Enter a secret as text or JSON with optional period, timestamp, algorithm, digits and token to verify.
- Use the current time by default, interpret supplied timestamps below 100 billion as Unix seconds and values of at least 100 billion as milliseconds, then compute HMAC over the time counter.
- Display the code; when a token is supplied in JSON, also report whether it matches the current or adjacent time step.
Frequently asked questions
How are TOTP input and defaults read?+
JSON input supplies secret, period, timestamp, digits, and algorithm; plain text is the secret. The default period is 30 seconds, digits 6, and algorithm SHA-1. A Base32-looking secret whose length is divisible by 8 is Base32-decoded; other secret text uses UTF-8. Only SHA-1, SHA-256, and SHA-512 are accepted, with 6–8 digits.
How is the timestamp converted to a counter?+
The counter is floor(seconds / period). A supplied Unix timestamp below 100000000000 is treated as seconds; a larger value is treated as milliseconds and divided by 1000. Thus 1700000000 and 1700000000000 represent the same time. Missing timestamp uses the current clock.
What reproducible TOTP example can I run?+
Submit `{ "secret": "12345678901234567890", "timestamp": 59, "period": 30, "digits": 8, "algorithm": "SHA-1" }`. It returns code `94287082`, the RFC 6238 SHA-1 reference value.
How does verification allow clock drift?+
Supply `token`, `code`, or `verify` in JSON, or a 6–8 digit secondary value. It compares the current code plus one previous and one next time-step; `valid` does not prove clocks are exactly synchronized.