Question 1

What is TOTP and how does it work?

Accepted Answer

TOTP (Time-Based One-Time Password, RFC 6238) generates a 6–8 digit code from a shared secret and the current time. The secret is combined with the current 30-second time window using HMAC-SHA1, then truncated to produce the visible code. Because both the authenticator app and the server know the shared secret and the current time, they independently compute the same code — no network communication required. TOTP is the standard behind Google Authenticator, Authy, and all OATH-compatible apps.

Question 2

What is the difference between TOTP and HOTP?

Accepted Answer

HOTP (HMAC-based One-Time Password, RFC 4226) generates codes based on an incrementing counter rather than time. Each time you press the button or request a code, the counter advances. The server must track which counter value was last used. TOTP (Time-Based OTP) replaces the counter with the current Unix time divided by 30. TOTP is preferred for authentication apps because time-based codes expire automatically, preventing replay attacks from captured codes.

Question 3

Why does my TOTP code expire every 30 seconds?

Accepted Answer

TOTP uses a 30-second time window (configurable, but 30s is the standard). The code is derived from floor(unixTimestamp / 30), so all devices with the same secret show the same code within the same 30-second interval. When the interval rolls over, a new code is derived. Most authenticator servers allow a 1-step tolerance (±30 seconds) to account for clock skew between devices. If codes are consistently wrong, check that your device's clock is synced.

Question 4

Is it safe to generate TOTP secrets in a browser?

Accepted Answer

Generating TOTP secrets in a browser is safe for testing and development because this tool runs entirely client-side — no secrets are transmitted to any server. However, for production systems, generate secrets server-side using a cryptographically secure random number generator and deliver them to users via QR code over HTTPS. Never store TOTP secrets in client-side storage (localStorage, cookies) in production — they should only live in your server database and the user's authenticator app.

免費的網頁開發者工具

OTP 產生器（TOTP/HOTP）

設定

密鑰

已產生的代碼

QR Code 設定

驗證代碼

OTP 驗證 URI

OTP 產生器的運作方式

工具功能說明

常見的開發者使用情境

資料格式與標準

常見陷阱與邊界情況

何時使用此工具 vs 程式碼