TOTP Simulator
Simulate and verify RFC 6238 Time-Based One-Time Passwords (2FA) in real-time. Compute authenticator codes with custom time steps, multi-window drift verification, and zero server communication.
RFC 6238 Authenticator
In-Browser RFC 6238 Time-Based One-Time Password Simulation and Verification
The TOTP Simulator computes, visualizes, and verifies Time-Based One-Time Passwords (TOTP) directly within your web browser. By executing the full HMAC-based one-time password algorithm in local memory using the native W3C Web Crypto API, developers and system administrators can debug multi-factor authentication workflows without transmitting shared secret keys across the network.
The simulator implements the RFC 6238 (TOTP) and RFC 4226 (HOTP) standards. It decodes Base32 secret keys (RFC 4648), derives a 64-bit counter from the current Unix epoch divided by the time interval (typically 30 seconds), computes an HMAC hash using SHA-1, SHA-256, or SHA-512, and performs dynamic truncation to generate standardized 6-digit or 8-digit verification passcodes.
This utility includes a large formatted code display, a real-time countdown progress ring, a multi-window drift analyzer that computes adjacent passcodes (t-1, t0, t+1) to troubleshoot clock skew discrepancies, a cryptographically secure random key generator, and standard otpauth:// URI export.
Core Tool Capabilities
- Hardware-Accelerated HMAC Computation: Computes SHA-1, SHA-256, and SHA-512 HMAC one-time passcodes natively in browser memory with zero network latency and complete secret isolation.
- Multi-Window Time Drift Analyzer: Calculates passcodes for the active window (t0) alongside previous (t-1) and upcoming (t+1) time steps to diagnose client/server clock skew issues instantly.
- Live Countdown Progress Indicator: Provides a visual 30-second countdown bar that updates dynamically to show the exact remaining validity window before the active passcode refreshes.
- Configurable Time Steps and Digits: Customizes time step intervals (15s, 30s, 60s), passcode lengths (6 or 8 digits), and hash algorithms to match diverse enterprise authentication policies.
- Key URI (otpauth://) Generation: Constructs canonical otpauth://totp/ key URIs with embedded issuer, account, and algorithm parameters for testing enrollment workflows.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Multi-Factor Authentication Backend Testing
- • Clock Drift and Skew Troubleshooting
- • Authenticator URI and Enrollment Verification
- • Two-Factor Authentication Security Auditing
Technical Specifications & Platform Limits
Official IETF two-factor authentication standards.
Full suite of HMAC digest algorithms.
Standard authenticator secret key encoding.
Zero external network requests or key storage.
Step-by-Step Workflow
Enter or Generate Secret Key
Paste an existing Base32 secret key into the workspace or click 'Generate Random Key' to create a cryptographically secure key.
Configure Hash and Step Parameters
Adjust the digest algorithm (SHA-1/256/512), passcode length (6 or 8 digits), time period (30s), and issuer metadata.
Monitor Active Passcode
Observe the active two-factor passcode update in real time alongside the live 30-second countdown progress indicator.
Test Clock Drift and Export
Paste a test code into the verification sandbox to verify drift against adjacent time windows, or copy the formatted otpauth:// URI.
Practical Real-World Use Cases
Multi-Factor Authentication Backend Testing
Backend developers verifying that custom 2FA validation endpoints correctly authenticate passcodes generated from shared Base32 secrets.
Clock Drift and Skew Troubleshooting
DevOps and site reliability engineers diagnosing failed login attempts by comparing user-submitted tokens against t-1 and t+1 time windows.
Authenticator URI and Enrollment Verification
Fullstack engineers testing whether generated otpauth://totp/ URIs parse correctly before generating user enrollment QR codes.
Two-Factor Authentication Security Auditing
Security analysts evaluating authentication systems against different hash algorithms (SHA-256/512) and varying time window constraints.
Frequently Asked Questions
- How does the Time-Based One-Time Password algorithm calculate passcodes?
- TOTP calculates a counter by dividing the current Unix timestamp in seconds by the time step interval (typically 30 seconds). It computes an HMAC hash over this counter using the shared Base32 secret key, extracts a 31-bit integer via dynamic truncation, and formats the result as a 6-digit or 8-digit passcode.
- Why might my generated passcode differ from a mobile authenticator app?
- TOTP is strictly time-dependent. If your computer's clock differs from standard NTP network time by even a few seconds, the active time window counter may temporarily mismatch. Use the Time Drift Analyzer to check if your code matches an adjacent window.
- Is SHA-1 safe when used within the TOTP algorithm?
- Yes. In the context of HMAC-based one-time passwords (RFC 6238), SHA-1 is used within an HMAC construction rather than as a collision-sensitive signature digest, meaning known collision attacks on raw SHA-1 do not weaken TOTP security.
- What is the function of the Time Window Drift Analyzer?
- The drift analyzer calculates codes for the previous 30 seconds (t-1), the current window (t0), and the next 30 seconds (t+1), allowing engineers to test whether an incoming passcode is valid within an acceptable server clock skew tolerance.
- Are my 2FA secret keys transmitted to an external server?
- No. All Base32 decoding, HMAC hashing, and time step calculations occur strictly within your web browser using native Web Crypto APIs. Private keys are never transmitted over the network.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind TOTP Simulator - Generate & Verify 2FA Codes with Drift Testing with our deep-dive educational content.