TOTP Authenticator Ring | mysimulator.uk

Shared Secret

TOTP Parameters

Time step (period) 30 s

Code length 6 digits

Time acceleration 1×

Live Readouts

Current code

000000

Next code in

30 s

Counter T

How it works

This is a real implementation of TOTP (RFC 6238), the algorithm behind Google Authenticator, Authy and every hardware OTP token. It runs genuine HMAC-SHA-1 via the browser's Web Crypto API on the secret you type — nothing here is faked.

T = floor(unixTime / period)
HOTP(K,T) = Truncate(HMAC-SHA-1(K,T)) mod 10^digits

Dynamic truncation:
offset = last_byte(HMAC) & 0x0F
bin    = (HMAC[offset]   & 0x7F) << 24
       | (HMAC[offset+1] & 0xFF) << 16
       | (HMAC[offset+2] & 0xFF) << 8
       | (HMAC[offset+3] & 0xFF)

Counter T — the shared secret and the current 30-second window (by default) are hashed together with HMAC-SHA-1, so both the phone app and the server independently derive the same 20-byte digest without ever transmitting it.
Dynamic truncation — 4 bytes are sliced out of the digest at a data-dependent offset (the low nibble of the last byte), then reduced mod 10^digits to get a short human-typeable code.
Ring & pointer — one tick per second of the current period; the pointer completes a full lap exactly when the counter T increments and a new code is generated (the key icosahedron flashes).
Time acceleration — sweeps the virtual clock forward faster than real time so you can watch many code rotations without waiting.

At 1× speed with the default period (30s) the code shown matches what a real authenticator app would display for the same Base32 secret at this exact second.

Elapsed ticks (this period) Ticks remaining HMAC key / new-code flash

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.