AltF Authenticator
TOTP code verifier
Enter a secret and a code, and the verifier checks it against the current time step and a window of steps on either side. It tells you which step matched, so you can see whether the device that made the code is ahead of or behind the real time, and by roughly how much. Nothing is sent to a server.
- Free, no sign-up
- Secrets stay in your browser
- RFC 6238 self-test built in
- Works on mobile
What a time-step window is
A server cannot expect phones to agree on the time to the second, and a person needs a few seconds to type the code. So most servers accept the current step and one step either side, giving roughly 90 seconds of tolerance with a 30-second period. RFC 6238 recommends allowing at most one previous step for network delay and keeping the window small, because a wider window gives an attacker more valid codes to guess.
Reading the result
- Matched step 0: the code is current. The clocks agree.
- Matched step -1 or +1: the code is from the previous or next period. Normal servers usually accept this.
- Matched step -3 or lower: the device that made the code is running about 90 or more seconds slow, or the code is old.
- No match in the window: the secret, the settings or the account is wrong, or the clock is far off.
For developers
A real verifier must also stop replay: once a code for a given step has been accepted, refuse the same code again, and limit the number of attempts per account. If you see the same drift from one user again and again, some systems remember that offset, as RFC 6238 describes for resynchronisation. This page does not track used codes, so it is a debugging aid, not a server.
TOTP code verifier: questions and answers
What window should my server use?
One step either side is the common choice for a 30-second period. Go wider only with rate limiting and a clear reason.
What does a drift of -60 seconds mean?
The code matched two steps in the past, so the device that made it is about a minute behind the time on this computer. Fix the clock on that device.
Can this verify codes for any service?
Yes, if you have the secret. Without the secret no tool can verify a code.
Does it send the secret or the code anywhere?
No. The check runs entirely in your browser.
Authenticator tools and 2FA guides
Guides
AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.