Test TOTP and HOTP locally

Use and verify the result

1. Input, one record per line

   Use RFC 4226 and RFC 6238 test secrets, a uint64 HOTP counter, or an explicit TOTP time, epoch and step. SHA-1, SHA-256, SHA-384 and SHA-512 and 6 to 8 digits are available; compare an expected code and inspect expiry. Secrets never enter reports, and no authenticator account is enrolled or contacted. SHA384 and non-SHA1 HOTP are explicitly local algorithm variants, not the RFC4226/6238 reference profiles.

2. Declared profile

   Choose the exact profile and provide only synthetic or your own authorized data. Inspect per-record errors, assumptions and unknowns before saving. Reopen native outputs with an independent format reader; a valid local result does not prove external acceptance. Cancelling, editing or resetting discards stale results.

3. Local processing and secrets

   Inputs stay in this tab and its terminable worker. No input, secret, filename or contact is sent to a service, stored, logged or measured. Fixed parser/code/metadata assets load from this site only for the selected job. Sensitive inputs have no original-backup button; private exports require an explicit choice and download. Reset or leave the page to release the references; memory erasure cannot be guaranteed by JavaScript. Test-secret fields accept multiple lines and are visible in this tab.

4. Resource limits

   At most1MiB combined UTF8 string/file bytes,200,000 UTF16 units per string,1,000 batch rows,32 nesting levels and20,000 input nodes; at most4MiB of export files and20 files. Every run ends or is terminated after15 seconds. CSR DER≤64KiB; DKIM headers≤128KiB/1,000 fields/8KiB per field and20,000 mail lines. TypeScript≤20 files,25,000 characters each/100,000 total,20,000 tokens per file,128 syntax levels,100,000 AST nodes and1,000 diagnostics. These are application limits, not a total worker-heap cap. CSV is UTF8, quoted, comma/CRLF, with formula-prefix protection and a declared null marker.