One-Time Password Generator

Purpose & User Intent: This tool generates RFC 4226 compliant one-time passwords (OTPs) for authentication workflows. It supports both time-based (TOTP) and counter-based (HOTP) schemes, enabling testing of MFA integrations, validation of login flows, and offline verification without external services. Target users include developers, QA engineers, security auditors, and DevOps engineers integrating MFA in apps. Conceptually, the tool takes a shared secret, decodes it into a byte sequence, computes an HMAC with the chosen algorithm, applies dynamic truncation to derive a numeric value, and reduces it modulo 10^digits to produce a fixed-length numeric code. For TOTP, the counter is floor(current Unix time / time_step); for HOTP, the counter is provided. Outputs include the current code and, when applicable, expiry time and counter used. Advanced options include selecting algorithm (SHA1, SHA256, SHA512), digits (6, 7, 8), support for Base32 or hex secrets, and exposing the computed code without persistent storage. This differentiates from simple pseudo-random generators by aligning with RFCs and providing deterministic results for given inputs. Real-world use cases: generating codes in CI pipelines to test MFA paths, validating backup code generation logic, simulating user devices during security reviews. Limitations include clock drift affecting TOT P accuracy, reliance on the secrecy and correctness of the shared secret, and the need to protect secret material. The tool does not perform authentication and should not be used as a credential source. It follows RFC 4226 and RFC 6238; outputs are numeric strings padded with leading zeros as required.