# OTP Generator

Generate and verify time-based one-time passwords.

## URL

https://ilham.dev/tools/otp-generator/

## What It Does

Generate time-based one-time passwords (TOTP, RFC 6238) from a shared secret, and verify a code you have been given. It shows the current code, the seconds until it rolls over and the next code, so you can compare against a device that may have drifted.

## Features

- Runs in the browser
- No login required

## Input

text input.

## Output

text output.

## Privacy

Processing happens locally in the browser.

No input data is uploaded to ilham.dev.

- Requires login: false
- Requires API key: false
- Stores user data: false


## Examples

- Is my secret sent anywhere?
- Why does the code not match my authenticator app?




## Questions

### Is my secret sent anywhere?

No. The HMAC is computed locally with WebCrypto. That said, do not paste a production secret into any page you do not control — including this one.

### Why does the code not match my authenticator app?

First check the secret, digit count, period, and hash algorithm expected by the service. Then check both clocks: a time-based code changes when its configured period ends. The page shows the time remaining on **your browser's** clock, not the remote server's time.