Authenticator Code Window Calculator

A time-based code is only valid for a short window, and every implementation widens that window a little to forgive clocks that disagree. The trade is exact and rarely stated: accepting one step either side means three codes are valid rather than one, which triples an attacker's odds on a blind guess. Whether that matters depends entirely on whether there is rate limiting behind it.

Code length

Between 4 and 10 digits.

Step (seconds)

How often the code changes. 30 is standard.

Steps either side

How much clock drift to forgive.

Your figures will appear here.

What this generator does

Counts the codes accepted at any moment — the current step plus the window either side — and works out both the drift that forgives and the chance a single blind guess is accepted.

How to use this tool

Set the code length and how often it changes.
Set how many steps either side to accept.
Read how many codes are valid at once and what a blind guess is worth.
Widen the window by one step and watch the odds move exactly as predicted.

Understanding the controls

Code length: Between 4 and 10 digits. Six is standard; each extra digit divides an attacker's odds by ten.
Step: How often the code changes, in seconds. Thirty is standard. A longer step forgives more drift per window but leaves each code valid longer.
Steps either side: How many past and future codes to accept. Zero is strictest and will reject users whose clocks are slightly off; one is the common compromise.

Common use cases

Choosing a validation window for a two-factor implementation
Understanding why users see codes rejected when their clock drifts
Quantifying the cost of a more forgiving window
Explaining a security design decision with numbers
Teaching how time-based codes actually work

How this generator works

The accepted count is twice the window plus the current step, which is why widening by one step adds two codes rather than one. The check confirms that arithmetic and, separately, that narrowing the window genuinely reduces the attacker's chance — a monotonic relationship that would catch a sign error the direct recomputation would not.

Randomness and fairness

Nothing here is random. The counts and odds follow entirely from the settings you choose.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

Blind guessing only. Rate limiting matters far more than window size, and is not modelled here.
Assumes each guess is independent, which holds for a blind attacker and not for one who has seen a previous code.
Does not model resynchronisation, where a server learns a client's persistent drift and adjusts for it.
Says nothing about the far more common real attack, which is asking the user for their code directly.

Privacy and your data

Every figure is computed in your browser, and no code or setting is transmitted or stored.