TOTP Code Ring — 2D HMAC Visualizer

Every "Google Authenticator" code on Earth comes from the same 1970s-simple idea: hash a shared secret together with the current time step, then keep six digits of the result. This simulator runs that algorithm for real — genuine HMAC-SHA-1 through the browser's Web Crypto API, dynamic truncation exactly as specified in RFC 6238 — against any Base32 secret you type in. A clock ring ticks once per second of the current time window and a live digest grid shows every one of the 20 raw HMAC bytes, with the exact 4-byte truncation window highlighted as it's picked out and folded into the final code. Drag the period, code-length and time-acceleration sliders — or drag across the ring itself to scrub through time — to see how each term in the formula changes what lands on the ring.