Security & CryptoLesson 343Free preview

TOTP Generator and Validator

This lesson is part of Web Developer Tools · All levels

Summary

TOTP (Time-based One-Time Password) is a verification code that changes every time period, usually 30 seconds. The code is calculated from the shared secret and the current time, then matched by the server. Because depending on the time, the server's hours and the authenticator's application must be synchronized for the code to be valid.

Key points

TOTP uses a secret together with a time step, usually 30 seconds.
Generally, the resulting code is six digits long.
Validation usually gives a tolerance of one period before or after
Secret enrollment is distributed via QR code containing otpauth URI://
Prevent the reuse of the same code (replay) on the server side

Full lesson

Code examples and quizzes

Full lessons, code examples, and quizzes are available to subscribers. 5 questions.