oathtool

A TOTP code is a function of a shared secret and the current time, so anyone with the secret computes the same six digits. oathtool --totp -b SECRET prints the code now; --now computes it for another time, handy for showing a stale code rejected without touching the clock. The server side (pam_google_authenticator) keeps the same secret in ~/.google_authenticator with its options (window size, reuse and rate-limit rules). --hotp is the counter-based variant.

oathtool command usage

oathtool --totp -b [--now=TIME] SECRET
oathtool --hotp -c COUNTER -b SECRET

Options

--totp

time-based one-time password (--hotp for counter-based)

-b

the secret is base32 (the usual enrolment form)

--now='3 minutes ago'

compute the code for that time instead of now

-w N

also print the N codes on either side (the accepted window)

oathtool examples

oathtool --totp -b KVKFKRCPNZQUYMLXOVYDSQKJKZDTSRLD

Prints the current six-digit code for that secret.

oathtool --totp -b SECRET --now='3 minutes ago'

Prints the code that was valid three minutes ago, to show it is now rejected.

Pitfalls

• A TOTP code is one-time and time-bound: it is good for only ~30-90 seconds and only once, so it cannot be scripted far ahead.
• The secret (seed) is as sensitive as a private key: whoever has it can generate every code.

Run it on real machines