Under the Hood: The Architecture of TOTP generator
Authenticator secrets should not be typed into a cloud TOTP site.
TOTP is HMAC-SHA1 over a 30-second time step. This page implements that locally. There is no origin fetch and no upload route. Inputs are strings, JSON, or File objects decoded with the platform APIs in this tab.
Memory Allocation & Browser Threading Mechanics
Work stays on the main thread because typical pastes are kilobytes, not gigabytes. useMemo or an explicit button recomputes a derived string. Image tools downsample onto a canvas so pixel loops stay bounded. Crypto uses SubtleCrypto, which returns ArrayBuffers the engine can recycle after you copy the result.
Algorithmic Deep-Dive: Code Snippet & Logical Analysis
const step = Math.floor(Date.now()/1000/30);
const hmac = await crypto.subtle.sign("HMAC", key, u64(step));
const offset = hmac[hmac.length-1] & 0xf;Treat the snippet as the contract: deterministic in, deterministic out. Invalid input should surface a string error, not a thrown render.
The Local Storage Sandbox & Volatile Data Pipelines
Default is React state only. Object URLs from canvases or downloads are revoked after click when the island uses URL.createObjectURL. There is no “recent jobs” IndexedDB. Close the tab to drop secrets (JWT HMAC keys, TOTP seeds, VAPID private JWK).
Verifying True Privacy: How to Audit Your Browser's Network Tab
F12 → Network → clear. Run the tool with a canary string such as TWA_CANARY_TOKEN. Filter Fetch/XHR. The canary must not appear in any request payload. Ads and analytics on the shell are unrelated to the island; they must not receive File bytes.