TOTP Time Step & Window Calculator

Understanding the TOTP time step calculator — concept and principle

TOTP (time-based one-time password) is the six-digit code in authenticator apps that changes every 30 seconds. Both your phone and the server derive the code from a shared secret and the current time. This calculator shows the time part: the counter T that both sides feed into the algorithm, how many seconds the current code has left, and the 8-byte counter value in hexadecimal. It helps when debugging codes that are "always wrong" or checking clock drift.

Phone and server divide the same clock by 30, so both land on counter 59,805,507 for this slice.

How it is calculated

RFC 6238 defines T = ⌊(Unix time − T0) / X⌋, with T0 = 0 and the step X usually 30 seconds.

Time step counter T: Unix time divided by the period, rounded down.
Seconds left: X − (Unix time mod X).
Counter in hex: T written as a 16-digit hexadecimal number, which is the 8-byte big-endian value hashed by HOTP.

Enter 0 to use your device's current clock, or enter a specific Unix time in seconds.

The principle

TOTP is HOTP (RFC 4226) with the counter replaced by time. HOTP computes HMAC-SHA1(secret, counter), picks 4 bytes from the result by "dynamic truncation" and reduces them modulo 10⁶ to get six digits. Because every 30-second window has one counter value, the server and the app produce the same code without talking to each other, as long as their clocks agree. Servers often also accept one neighbouring step to tolerate small clock drift and typing delay.

Worked example

The default uses the live clock, so your numbers change every time. Here is the result captured at Unix time 1,794,165,215 (2026-11-08 19:13:35 UTC).

Inputs: Unix time = now (1,794,165,215 s), period = 30 s.
T = ⌊1,794,165,215 / 30⌋ = 59,805,507.
1,794,165,215 mod 30 = 5, so seconds left = 30 − 5 = 25.
59,805,507 in hexadecimal is 3908F43, padded to 16 digits: 0000000003908f43.

Each point is the calculator re-run with only “Period (s)” changed; the gold point is the default example. Change the inputs above and this chart follows your numbers.

Period (s)	Time step counter T
7.5	239,225,030
15	119,612,515
22.5	79,741,676
30	59,806,257
37.5	47,845,006
45	39,870,838
60	29,903,128

How to read the result

If your code is rejected, compare T from your phone's clock with T from the server's clock. A difference of one step means the clocks are about 30 seconds apart; enable automatic time on the device. Seconds left tells you whether to wait for a fresh code before typing.

Common mistakes

Using local time instead of Unix time (always UTC-based).
Changing the period to 60 s on one side only; the counters then disagree.
Assuming the code is secure if the secret has leaked; anyone with the secret can generate valid codes.

Keep in mind: This tool shows only the time counter and never handles your secret. Keep TOTP seeds private, and remember that TOTP can still be phished in real time; phishing-resistant methods such as passkeys protect better.

Frequently asked questions

Why does my authenticator code not work?

Most often the device clock is off. Turn on automatic date and time and try again.

Can TOTP use other hashes or lengths?

Yes. RFC 6238 allows HMAC-SHA256 and HMAC-SHA512 and 6 to 8 digits, but most apps use SHA-1, 6 digits and 30 seconds.

When will the 8-byte counter overflow?

Not for billions of years; 64 bits of 30-second steps last far beyond any practical horizon.

Sources: IETF RFC 6238, TOTP: Time-Based One-Time Password Algorithm · IETF RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm

Checked 8 Nov 2026. Standard formulas and RFC/IEEE definitions, computed locally in your browser — nothing you type is sent anywhere.

Your numbers