TOTPジェネレーター - ワンタイムパスワード生成・検証 オンライン

// TOTP Generator using Web Crypto API (RFC 6238)

function base32Decode(base32) {
  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
  const cleaned = base32.toUpperCase().replace(/[^A-Z2-7]/g, '');
  let bits = '';
  for (const char of cleaned) {
    const val = alphabet.indexOf(char);
    if (val === -1) throw new Error(`Invalid Base32 character: ${char}`);
    bits += val.toString(2).padStart(5, '0');
  }
  const bytes = new Uint8Array(Math.floor(bits.length / 8));
  for (let i = 0; i < bytes.length; i++) {
    bytes[i] = parseInt(bits.substr(i * 8, 8), 2);
  }
  return bytes;
}

async function generateTOTP(secret, options = {}) {
  const {
    algorithm = 'SHA-1',
    digits = 6,
    period = 30,
    timestamp = Date.now(),
  } = options;

  const counter = Math.floor(timestamp / 1000 / period);
  const counterBuffer = new ArrayBuffer(8);
  const counterView = new DataView(counterBuffer);
  counterView.setUint32(4, counter, false);

  const keyBytes = base32Decode(secret);
  const cryptoKey = await crypto.subtle.importKey(
    'raw', keyBytes,
    { name: 'HMAC', hash: algorithm },
    false, ['sign']
  );

  const hmacBuffer = await crypto.subtle.sign('HMAC', cryptoKey, counterBuffer);
  const hmac = new Uint8Array(hmacBuffer);

  const offset = hmac[hmac.length - 1] & 0x0f;
  const code =
    ((hmac[offset] & 0x7f) << 24) |
    ((hmac[offset + 1] & 0xff) << 16) |
    ((hmac[offset + 2] & 0xff) << 8) |
    (hmac[offset + 3] & 0xff);

  const otp = code % Math.pow(10, digits);
  return otp.toString().padStart(digits, '0');
}

function generateSecret(bits = 160) {
  const bytes = new Uint8Array(bits / 8);
  crypto.getRandomValues(bytes);
  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
  let result = '', buffer = 0, bufferLength = 0;
  for (const byte of bytes) {
    buffer = (buffer << 8) | byte;
    bufferLength += 8;
    while (bufferLength >= 5) {
      bufferLength -= 5;
      result += alphabet[(buffer >> bufferLength) & 0x1f];
    }
  }
  if (bufferLength > 0) {
    result += alphabet[(buffer << (5 - bufferLength)) & 0x1f];
  }
  return result;
}

// Usage:
// const secret = generateSecret();
// const code = await generateTOTP(secret);
// console.log('TOTP:', code);