TOTP Authenticator

How it works

This implements the real RFC 6238 TOTP algorithm: your base32 secret is decoded to raw bytes, the current time divided by the 30-second step becomes an 8-byte counter, and Web Crypto's crypto.subtle.sign() computes an HMAC-SHA1 over that counter — the RFC 4226 dynamic truncation rule then picks 4 bytes out of the resulting hash and reduces them to the 6-digit code, refreshed every second in this browser.

FAQ

Why does the code change every 30 seconds?

That's the TOTP time step defined in RFC 6238 — the current Unix time divided by 30 becomes a counter that's hashed together with your secret, so any device computing it from the same secret in the same 30-second window produces the same code.

Does this sync my codes to the cloud like some authenticator apps?

No — accounts and secrets are stored only in this browser's local storage; there's no account or server sync, so clearing browser data or switching devices means re-adding accounts from their original QR codes or setup keys.