Encoding and security guides
TOTP codes: check the secret, period and clock drift
Reproduce a public TOTP vector and align algorithm settings and clock time with the authenticator.
Time chooses the counter
TOTP computes a moving counter from Unix time and a configured step. The code then depends on that counter, the secret and algorithm settings.
A timezone display difference does not change Unix time. Correct the device clock rather than changing the displayed timezone to make codes match.
Match all parameters
Confirm the hash algorithm, number of digits, time period and secret encoding. The common six-digit SHA-1 configuration is not every deployment’s rule.
Base32 represents the secret bytes; it is not an extra password. Keep spaces and copied provisioning decorations out unless the implementation explicitly permits them.
Use a published test vector
RFC 6238 supplies public interoperability vectors. With the stated SHA-1 secret, eight digits, 30-second step and time 59, the code is 94287082.
This is public test data, not a real account secret. Nav Tools uses SHA-1 with 6–8 digits and 30–60-second periods; its current-time UI does not expose historical test timestamps.
Secret bytes (ASCII): 12345678901234567890
Algorithm: SHA-1 Digits: 8 Period: 30
Unix seconds: 59 Expected: 94287082Verification belongs on the server
A server may allow a narrow adjacent time window for clock drift. A wide window increases accepted codes and should not replace clock synchronization.
Reject reuse as required, rate-limit verification attempts and protect the shared secret. Nav Tools calculates codes locally and does not enforce account security.