Question 1

What is TOTP and how does it work?

Accepted Answer

TOTP (Time-Based One-Time Password, RFC 6238) generates a 6–8 digit code from a shared secret and the current time. The secret is combined with the current 30-second time window using HMAC-SHA1, then truncated to produce the visible code. Because both the authenticator app and the server know the shared secret and the current time, they independently compute the same code — no network communication required. TOTP is the standard behind Google Authenticator, Authy, and all OATH-compatible apps.

Question 2

What is the difference between TOTP and HOTP?

Accepted Answer

HOTP (HMAC-based One-Time Password, RFC 4226) generates codes based on an incrementing counter rather than time. Each time you press the button or request a code, the counter advances. The server must track which counter value was last used. TOTP (Time-Based OTP) replaces the counter with the current Unix time divided by 30. TOTP is preferred for authentication apps because time-based codes expire automatically, preventing replay attacks from captured codes.

Question 3

Why does my TOTP code expire every 30 seconds?

Accepted Answer

TOTP uses a 30-second time window (configurable, but 30s is the standard). The code is derived from floor(unixTimestamp / 30), so all devices with the same secret show the same code within the same 30-second interval. When the interval rolls over, a new code is derived. Most authenticator servers allow a 1-step tolerance (±30 seconds) to account for clock skew between devices. If codes are consistently wrong, check that your device's clock is synced.

Question 4

Is it safe to generate TOTP secrets in a browser?

Accepted Answer

Generating TOTP secrets in a browser is safe for testing and development because this tool runs entirely client-side — no secrets are transmitted to any server. However, for production systems, generate secrets server-side using a cryptographically secure random number generator and deliver them to users via QR code over HTTPS. Never store TOTP secrets in client-side storage (localStorage, cookies) in production — they should only live in your server database and the user's authenticator app.

무료 웹 개발자 도구

OTP 생성기 (TOTP/HOTP)

설정

비밀 키

생성된 코드

QR 코드 설정

코드 확인

OTP 인증 URI

OTP 생성기 작동 방식

도구가 하는 일

개발자들이 흔히 사용하는 사례

데이터 형식 및 표준

흔한 함정과 엣지 케이스

코드 대신 이 도구를 사용해야 하는 경우