TOTP / HOTP Demo
Generate time- or counter-based OTPs locally and compare test codes.
About this tool
Generate a code from a Base32 test secret, or enter an optional code to compare. RFC example loads public test data for the selected mode and hash. This is a local learning tool, not account authentication.
TOTP follows RFC 6238 with epoch T0 = 0: the counter is floor(timestamp / step). SHA-1, SHA-256 and SHA-512 use the selected 6 or 8 digits. The chosen timestamp is a snapshot; Now updates the input, it is not a live countdown. Calculation details show the exact counter and half-open interval [start, end), plus remaining seconds at that timestamp.
TOTP compares ±0–10 steps, skipping negative counters. All matching offsets are shown if a short code collides. HOTP uses RFC 4226 HMAC-SHA-1 and an unsigned 64-bit decimal counter, including values beyond JavaScript’s safe-number range. Its 0–10 look-ahead checks the chosen counter and following counters only; it does not advance or store a server counter.
Base32 is case-insensitive; whitespace and hyphens may separate groups. Only the ASCII RFC alphabet is accepted. Correct padding is optional, but trailing bits must be zero; invalid lengths, padding, characters and truncated-byte aliases are rejected. Limit: 4,096 raw secret characters. Short secrets are allowed for test vectors; their strength is not evaluated. Time and step must be safe integer seconds, timestamp nonnegative, step positive.
Changes, Cancel and navigation discard old results and stop further window checks. Web Crypto operations already in flight cannot themselves be aborted; a five-second deadline ignores their eventual result. No secret or code is saved in cookies or browser storage or uploaded. Fields clear when leaving the tool; this is not a guarantee of secure memory erasure. No replay prevention, throttling, provisioning URI or account verification.