Question 1

What is TOTP and how does it work?

Accepted Answer

TOTP (Time-Based One-Time Password, RFC 6238) generates a 6–8 digit code from a shared secret and the current time. The secret is combined with the current 30-second time window using HMAC-SHA1, then truncated to produce the visible code. Because both the authenticator app and the server know the shared secret and the current time, they independently compute the same code — no network communication required. TOTP is the standard behind Google Authenticator, Authy, and all OATH-compatible apps.

Question 2

What is the difference between TOTP and HOTP?

Accepted Answer

HOTP (HMAC-based One-Time Password, RFC 4226) generates codes based on an incrementing counter rather than time. Each time you press the button or request a code, the counter advances. The server must track which counter value was last used. TOTP (Time-Based OTP) replaces the counter with the current Unix time divided by 30. TOTP is preferred for authentication apps because time-based codes expire automatically, preventing replay attacks from captured codes.

Question 3

Why does my TOTP code expire every 30 seconds?

Accepted Answer

TOTP uses a 30-second time window (configurable, but 30s is the standard). The code is derived from floor(unixTimestamp / 30), so all devices with the same secret show the same code within the same 30-second interval. When the interval rolls over, a new code is derived. Most authenticator servers allow a 1-step tolerance (±30 seconds) to account for clock skew between devices. If codes are consistently wrong, check that your device's clock is synced.

Question 4

Is it safe to generate TOTP secrets in a browser?

Accepted Answer

Generating TOTP secrets in a browser is safe for testing and development because this tool runs entirely client-side — no secrets are transmitted to any server. However, for production systems, generate secrets server-side using a cryptographically secure random number generator and deliver them to users via QR code over HTTPS. Never store TOTP secrets in client-side storage (localStorage, cookies) in production — they should only live in your server database and the user's authenticator app.

أدوات مجانية لمطوري الويب

مولّد OTP (TOTP/HOTP)

الإعدادات

المفتاح السري

الرمز المُنشأ

إعدادات رمز QR

تحقق من الرمز

معرّف URI لمصادقة OTP

كيف يعمل مولّد OTP

ما الذي تفعله الأداة

حالات استخدام شائعة للمطورين

تنسيقات البيانات والمعايير

المزالق الشائعة والحالات الطرفية

متى تستخدم هذه الأداة بدلًا من الكود