How wide should a TOTP acceptance window be?

RFC 6238 recommends accepting 1 step before and after current time (total 3 windows = 90 seconds). This handles up to 30 seconds of clock drift. Wider windows increase replay attack surface. Most enterprise systems use +/-1 step (T-1, T, T+1).

What causes TOTP codes to fail?

Primary cause: clock drift > 30 seconds between device and server. Fix: sync server to NTP (accuracy < 1s), accept +/-1 time step. Secondary: user reading old code at window boundary. Recommend apps with countdown timers to show remaining validity.

TOTP Window Validity and Drift Calculator

Calculate TOTP time window validity accounting for clock drift. Determine acceptable window size to balance usability against replay attack risk.

Networking

Algorithms

Binary & Number

Systems

Dev Metrics

IP Subnet Calculator

IP Address

CIDR Prefix

Network

192.168.1.0

Broadcast

192.168.1.255

Subnet Mask

255.255.255.0

First Host

192.168.1.1

Last Host

192.168.1.254

Usable Hosts

254

Binary breakdown:

IP: 11000000.10101000.00000001.00000000

Mask: 11111111.11111111.11111111.00000000

Net: 11000000.10101000.00000001.00000000

How to Use

Enter the values for the patient or scenario you are assessing. Calculate TOTP time window validity accounting for clock drift. Determine acceptable window size to balance usability against replay attack risk. Use the totp window validity result to inform your clinical assessment.

Related Calculators

JWT Expiry Risk

AI & Technology

OAuth PKCE Entropy