Time-based one-time passwords
The Time-Based One-Time Password algorithm (TOTP) derives a short authentication code from a shared secret and a time counter. It extends the HMAC-Based One-Time Password algorithm by replacing its event counter with a value calculated from the current time.
Time steps
RFC 6238 recommends a default interval of 30 seconds. The client and verifier calculate a counter from the Unix time and the selected interval. Their clocks must be sufficiently synchronized for the verifier to accept the generated code.
Browser implementation
The TOTP tool accepts named Base32 secrets and generates six-digit codes using HMAC-SHA-1 and 30-second intervals. A circular indicator shows the time left in the current interval.
Accounts are stored in local browser storage for the domain being used. Export produces a JSON file containing the account names and readable secrets. Import appends new secrets and skips duplicates without replacing existing accounts.