1. 01Paste a Base32 secret or a complete otpauth:// URI; the latter has its secret, issuer, account, digits, period and algorithm split out automatically.
2. 02Choose the digit count, period and algorithm; the default is the 6-digit, 30-second, SHA-1 combination most authenticators use.
3. 03Read the current code, the seconds remaining and the next code.
4. 04Generate a 160-bit random secret, or copy the URI or secret and download the QR code.

• The implementation is time-based TOTP; it reuses an HOTP calculation underneath, but the page has no manual counter-increment HOTP mode.
• The Base32 has to be accepted by the local parser; an invalid character or URI parameter raises an error.
• TOTP depends on the device's system time, and a clock offset makes codes disagree with the server; the tool does not synchronise time over the network.
• The QR code is drawn on a canvas by the bundled qrcode library and contains the full secret; downloading or sharing the QR code is equivalent to sharing the key.
• The issuer and account go into the otpauth URI for the authenticator's label only; the cryptographic result depends mainly on the secret, the time, the digit count, the period and the algorithm.
• This is a sensitive-credential tool: even though the page uploads nothing, production account secrets should not be entered on an untrusted device.

Secrets and codes are computed in browser memory with WebCrypto HMAC; the implementation deliberately writes nothing to local storage and sends nothing to a server, and a refresh clears everything.