OneFreePlace

TOOL #380 · RFC 6238 OTP LAB

RFC 6238 OTP LAB

TOTP Generator

Generate, inspect and verify standards-based time one-time passwords with clock-window diagnostics and zero secret uploads.

Runs locally · secrets are not uploaded

Seed & parameters

Web Crypto

Base32 secret

Spaces and hyphens are accepted for readability; canonical Base32 is used internally. This field is never persisted by the tool.

Issuer / service

Account label

HMAC algorithm

Digits

Period (seconds)

Time source

Unix timestamp (seconds)

Import otpauth:// URI

Maximum compatibility profile: SHA1 · 6 digits · 30 seconds.

Current one-time password

------

Calculating…

Counter—

Secret size—

Period start—

Period end—

Neighbouring windows

Verify a code locally

One-time password

Allowed ± windows

Reference Unix timestamp

Enter a code to determine whether it matches the current, previous or next TOTP window.

Clock diagnostics

Device Unix time

—

Device ISO time

—

Selected counter

—

Time-step advice

Keep authenticator and verifier clocks synchronized. Wider acceptance windows improve tolerance but increase replay opportunity.

Dynamic truncation inspector

Counter bytes

—

HMAC digest

—

Offset

—

31-bit integer

—

Modulo

—

Why this is useful

Use the inspector when implementing TOTP in another language. You can compare the exact 8-byte counter, HMAC, dynamic-truncation offset and final modulo result step by step.

RFC 6238 defines TOTP as HOTP over a time-derived counter. The default time step is 30 seconds and the counter must support values beyond 32 bits.

Security checklist

Protect the seedAnyone with the Base32 secret can generate the same codes. Treat it like a password and avoid screenshots or shared logs.

Use a narrow verification windowOne adjacent 30-second step is a common tolerance. Larger windows create a larger acceptance/replay surface.

Check the clockTime drift is a common reason valid-looking codes fail.

Compatibility

SHA1, 6 digits and a 30-second period remain the safest interoperability defaults for authenticator apps. RFC 6238 also specifies SHA256 and SHA512. Some authenticator implementations may ignore non-default otpauth parameters, so test advanced profiles with the target app.