TOTP Time Drift Calculator
Work out totp time drift instantly with clear inputs, formula shown and shareable results.
About TOTP Time Drift Calculator
TOTP derives the code from floor(unix time / step), so any clock difference larger than the step produces a different code. Servers therefore accept a window of adjacent steps, typically one either side, which tolerates 30 seconds of drift in each direction. Every extra step of tolerance triples or expands the number of simultaneously valid codes, weakening the factor proportionally.
Formula
TOTP validation window
counter = floor(unix time / step); tolerated drift = window x step; codes valid at once = 2 x window + 1
Worked example
With the default values below, TOTP Time Drift Calculator returns Drift measured in time steps of 1.50. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Client clock driftaccepts -600–600 s
- 45 s
- TOTP time stepaccepts 10–300 s
- 30 s
- Acceptance window either sideaccepts 0–10 steps
- 1 steps
Results
- Drift measured in time steps
- 1.50 steps
- Drift the server tolerates
- 30 s
- Codes valid at any instant
- 3
- Validation outcome
- Code will be rejected - client clock must be synchronised
Step by step
- 1Values used
- 2TOTP validation window
- 3Drift measured in time steps= 1.50 steps
- 4Drift the server tolerates= 30 s
- 5Codes valid at any instant= 3
- 6Validation outcome= Code will be rejected - client clock must be synchronised
Assumptions and limits
- The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why not use a large acceptance window?
Each additional step multiplies the number of valid codes, increasing both guessing probability and the replay window. One step either side is the usual compromise.
How is drift handled properly?
Run NTP on servers and store a per-user drift correction learned from successful authentications, rather than widening the window for everyone.
Related Calculators
- Backup Encryption Time Calculator
- Certificate Chain Validation Time Calculator
- Containment Time Budget Calculator
- One Time Pad Length Calculator
- Proof Of Work Time Calculator
- Secure Erase Time Calculator
- Time To Remediate Calculator
- Access Review Effort Calculator
- Alert Triage Capacity Calculator
- Annualised Loss Expectancy Calculator
You might also need
- Time To Remediate CalculatorAlso in Security, Cryptography & Risk
- Backup Encryption Time CalculatorAlso in Security, Cryptography & Risk
- Containment Time Budget CalculatorAlso in Security, Cryptography & Risk
- Proof Of Work Time CalculatorAlso in Security, Cryptography & Risk
- Secure Erase Time CalculatorAlso in Security, Cryptography & Risk
- Certificate Chain Validation Time CalculatorAlso in Security, Cryptography & Risk
