TOTP Generator & Verifier

Abstract

TOTP Generator & Verifier is a client-side security and utility tool hosted on lab.johlem.net. Generate and verify Time-based One-Time Passwords (RFC 6238) with provisioning URI builder. All processing occurs entirely in the browser using standard Web APIs — no data is transmitted to any server, making the tool suitable for use with sensitive data in professional environments.

Architecture

1. Client-side processing

The tool runs entirely in the browser. All computations, parsing, encoding, and analysis are performed using JavaScript and the Web Crypto API where applicable. No server-side processing is involved, which means:

• Sensitive data (passwords, hashes, tokens, keys) never leaves the user's device
• The tool works offline once the page is loaded
• No user data is logged, stored, or transmitted

2. Zero dependencies

The implementation uses vanilla JavaScript with no external libraries or frameworks. This eliminates supply-chain risk and ensures the tool remains functional without CDN availability. Font loading (Barlow Condensed, JetBrains Mono) is the only external resource.

3. Input handling

User input is processed through DOM APIs with proper escaping. Output is rendered using textContent or sanitised HTML construction to prevent XSS. No eval() or innerHTML with unsanitised user data is used.

Privacy & Compliance

• GDPR: No personal data collection, no cookies, no tracking
• DORA: Suitable for financial sector use — zero data exfiltration risk
• OWASP: XSS prevention through proper output encoding

Stack & Tooling

• Languages: HTML5, CSS3 (custom properties), vanilla JavaScript
• Libraries: none — zero external dependencies
• Fonts: Barlow Condensed (condensed sans-serif), JetBrains Mono (monospace) self-hosted WOFF2
• APIs: Web Crypto API, Clipboard API, File API where applicable
• Hosting: static file server
• Build tools: none

Limitations

• Client-side only — cannot perform live network lookups, DNS queries, or certificate fetches from the browser sandbox
• Performance bounded by browser JavaScript engine for large inputs
• No persistent state — data is lost on page reload