Question 1

What is TOTP and how does it work?

Accepted Answer

TOTP (Time-Based One-Time Password, RFC 6238) generates a 6–8 digit code from a shared secret and the current time. The secret is combined with the current 30-second time window using HMAC-SHA1, then truncated to produce the visible code. Because both the authenticator app and the server know the shared secret and the current time, they independently compute the same code — no network communication required. TOTP is the standard behind Google Authenticator, Authy, and all OATH-compatible apps.

Question 2

What is the difference between TOTP and HOTP?

Accepted Answer

HOTP (HMAC-based One-Time Password, RFC 4226) generates codes based on an incrementing counter rather than time. Each time you press the button or request a code, the counter advances. The server must track which counter value was last used. TOTP (Time-Based OTP) replaces the counter with the current Unix time divided by 30. TOTP is preferred for authentication apps because time-based codes expire automatically, preventing replay attacks from captured codes.

Question 3

Why does my TOTP code expire every 30 seconds?

Accepted Answer

TOTP uses a 30-second time window (configurable, but 30s is the standard). The code is derived from floor(unixTimestamp / 30), so all devices with the same secret show the same code within the same 30-second interval. When the interval rolls over, a new code is derived. Most authenticator servers allow a 1-step tolerance (±30 seconds) to account for clock skew between devices. If codes are consistently wrong, check that your device's clock is synced.

Question 4

Is it safe to generate TOTP secrets in a browser?

Accepted Answer

Generating TOTP secrets in a browser is safe for testing and development because this tool runs entirely client-side — no secrets are transmitted to any server. However, for production systems, generate secrets server-side using a cryptographically secure random number generator and deliver them to users via QR code over HTTPS. Never store TOTP secrets in client-side storage (localStorage, cookies) in production — they should only live in your server database and the user's authenticator app.

免费的 Web 开发者工具

OTP 生成器（TOTP/HOTP）

配置

密钥

生成的代码

二维码设置

验证代码

OTP 认证 URI

OTP 生成器的工作原理

工具功能

常见开发者使用场景

数据格式与标准

常见陷阱与边界情况

何时使用此工具而非代码