# OTP Generator Guide

Generate and verify time-based one-time passwords.

- Tool: https://ilham.dev/tools/otp-generator/
- Guide URL: https://ilham.dev/guides/otp-generator/
- Tool guides index: https://ilham.dev/guides/tools/
- Broader guide: Security and Cryptography Basics for Developers (https://ilham.dev/guides/security-cryptography-basics/)

## What it does

Generate time-based one-time passwords (TOTP, RFC 6238) from a shared secret, and verify a code you have been given. It shows the current code, the seconds until it rolls over and the next code, so you can compare against a device that may have drifted.

## Use the tool

Open https://ilham.dev/tools/otp-generator/, add the input the tool asks for, run it, and check the output before using it elsewhere.

## Input and output

- Input: text.
- Output: text.
- Category: Web.

## Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.

## Questions

### Is my secret sent anywhere?

No. The HMAC is computed locally with WebCrypto. That said, do not paste a production secret into any page you do not control — including this one.

### Why does the code not match my authenticator app?

Almost always clock drift. TOTP depends on both sides agreeing which 30-second window it is; the tool shows the remaining seconds so you can see the disagreement.