A short companion for OTP Generator: when it is useful, what it expects, and what to check before using the result.
What it does
Generate time-based one-time passwords (TOTP, RFC 6238) from a shared secret, and verify a code you have been given. It shows the current code, the seconds until it rolls over and the next code, so you can compare against a device that may have drifted.
Use the tool
Open OTP Generator, add the input the tool asks for, run it, and check the output before using it elsewhere.
Input and output
- Input: text.
- Output: text.
- Category: Web.
Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.
Questions
Is my secret sent anywhere?
No. The HMAC is computed locally with WebCrypto. That said, do not paste a production secret into any page you do not control — including this one.
Why does the code not match my authenticator app?
Almost always clock drift. TOTP depends on both sides agreeing which 30-second window it is; the tool shows the remaining seconds so you can see the disagreement.
Related guide
For broader background, see Security and Cryptography Basics for Developers.