TOTP Authenticator

TOTP is HOTP with the counter set to floor(unix_time / 30). HOTP (RFC 4226) is HMAC-SHA1(secret, counter), then truncate the 20-byte HMAC to 4 bytes via "dynamic truncation" (use the low 4 bits of the last byte as an offset, take 4 bytes from there), interpret as a 31-bit integer, modulo 10^digits. TOTP (RFC 6238) is the same algorithm with time-based counter.

The default parameters that 99% of services use: SHA1, 30-second step, 6 digits. Some (Steam, Battle.net) use 5 digits; some use SHA256 or SHA512; the otpauth:// URI specifies all of them. Mismatched algorithm parameters are the most common "the code is rejected" cause — both sides must agree.

• Server time wrong — the server's clock is more than 30 seconds off from real time. Verifiers usually accept the previous and next 30-second window (±90s tolerance total). Beyond that, every code is wrong.
• Phone time wrong — same problem, on your side. Phones sync via NTP automatically; airplane mode + battery pull can drift you a few seconds. Most authenticator apps have a "fix time" feature.
• Period mismatch — you scanned an otpauth:// URI with period=60, your app assumes 30. Codes look valid but only match every other window. Re-scan or import with explicit period.
• SHA256 / SHA512 mismatch — same story. The otpauth URI carries algorithm=SHA256; if you typed the secret manually into Google Authenticator (which assumes SHA1), the codes never match.
• Wrong digit count — Steam uses 5-digit codes with a custom alphabet (not just 0-9). Battle.net uses 8 digits. Generic authenticators show the wrong format.

• You are implementing TOTP on the server side and need ground-truth codes to test your verification against — feed your test vectors, compare codes.
• You scanned a QR code on screen B but the camera app is on phone A — extract the secret from the otpauth:// URI manually and generate the code here.
• You are migrating from one authenticator app to another and want to verify the imported secrets produce the same codes as the old app before deleting the old one.
• Your phone is dead, you have the otpauth:// URI saved (because you exported your secrets when you set them up — you did, right?), and you need to log in now.

• It will not store your secret. Refresh the tab and it is gone. For persistent codes you want a dedicated authenticator app — 2FAS, Aegis, Raivo OTP — that backs up its secret store securely.
• It will not bypass account lockouts. If the verifier has rate-limited you after wrong codes, valid codes from here will not help until the lockout expires.
• It will not handle vendor-specific OTP. Steam Guard uses a different alphabet, Microsoft Authenticator has its own protocol on top of TOTP for push, RSA SecurID uses a different algorithm entirely (and a hardware seed).