RFC 6238: The Time-Based One-Time Password Standard
Time-based One-Time Passwords (TOTP) are governed by IETF RFC 6238. The algorithm computes a unique 6-digit or 8-digit code using a shared secret key and the current Unix timestamp.
The Core Formula
The time counter T is calculated as:
CODE
T = floor((Current Unix Time - T0) / X)
Where T0 is 0 (epoch time) and X is the time step size (typically 30 seconds).
HMAC-SHA1 Computation
The secret key and counter T are fed into an HMAC-SHA1 hashing function. Dynamic truncation extracts a 31-bit integer, which is modulo 10^6 to produce the final 6-digit code.
Try testing TOTP token generation directly using our client-side Web Authenticator, which runs standard RFC 6238 computations entirely in Javascript.
Did you find this helpful?
3