I am currently working on a desktop TOTP client.

From the TOTP spec at https://www.rfc-editor.org/rfc/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time).

But what is "time"? The spec says that the time is in the format of a Unix time epoch (seconds that have elapsed since Jan 01 1970).

My question is,

What how do I compute this Unix time?

  • a) Do I get UTC time & convert it to Unix time epochs?
  • b) Do I get local time & convert it to Unix time epochs?


  • c) Converting both UTC & local time to Unix time gives the same value so it will not matter?

1 Answer 1


I think this simply comes down to the definition of Unix time, which is given in the Wikipedia article:

Unix time (also known as POSIX time[1][2] or UNIX Epoch time[3]) is a system for describing a point in time. It is the number of seconds that have elapsed since 00:00:00 Thursday, 1 January 1970,[2] Coordinated Universal Time (UTC), minus leap seconds. Every day is treated as if it contains exactly 86400 seconds,[2] so leap seconds are to be subtracted since the epoch.

Although I would have described it as "without taking leap seconds into account" myself. Generally you should be able to get the Unix time from some time API or old API function, but otherwise (a) seems to be most reasonable. The Wikipedia article also contains ways of converting from different time formats, specifically UTC.

  • $\begingroup$ Thanks, I didn't know the part where Unix time is explicitly derived from UTC :) $\endgroup$
    – M4X_
    Aug 13, 2019 at 8:30
  • 1
    $\begingroup$ Having had to implement the protocol myself, I think the protocol is really sparsely defined. Not that that is necessarily bad, but it does always feel like I have to discover things for myself and then hope that they are right... So it's definitely not just you that's left with questions. $\endgroup$
    – Maarten Bodewes
    Aug 13, 2019 at 8:32
  • $\begingroup$ @MaartenBodewes I agree. The biggest problem I had was figuring out how the key is shared. Some services do base64, some do base32, and the TOTP (HOTP with extra steps) spec does not specify how to share the key, but rather gives a key and some testcases. $\endgroup$
    – Dragas
    Feb 21, 2023 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.