A production-oriented, local-first browser workbench for OTP credentials and WebAuthn/passkey evidence. It is part of the add·ideas Toolbox, but its release ZIP also runs as a standalone static application.

Authentication material stays in the active tab. The application has no backend, telemetry, automatic network lookup, service worker, cookie, local-storage credential store, or IndexedDB database.

Current source capabilities

RFC 4226 HOTP and RFC 6238 TOTP generation and bounded diagnostic verification using SHA-1, SHA-256 or SHA-512, with exact 64-bit counters and preserved leading zeroes.
Strict otpauth:// parsing/serialization, random secret generation, masked values, interoperability findings, live period display and a project-owned QR encoder.
Auditable TOTP time travel using positive/negative period offsets or a frozen local date/time in an explicit IANA timezone, including DST-gap rejection and repeated-time disambiguation.
Bounded clock-drift search, past/current/future OTP timelines, downloadable interoperability vectors and custom RFC 6238 T0 diagnostics.
RFC 6287 OCRA-1 suite parsing and computation for counter, numeric/alphanumeric/hex challenge, PIN/password hash, session and timestamp inputs. Official RFC interoperability vectors cover SHA-1, SHA-256 and SHA-512 paths.
Import of line-delimited provisioning URIs, complete Google Authenticator multi-QR batches, Aegis plaintext JSON, 2FAS JSON, andOTP plaintext JSON, legacy FreeOTP JSON, the documented CSV shape and RFC 6030 PSKC files containing plain secrets. Unsupported encrypted vendor formats are rejected rather than guessed.
Cross-browser QR image decoding through native BarcodeDetector when available and a bundled jsQR fallback everywhere else.
Credential-collection health reports for duplicated secrets/labels, weak secret lengths and non-default timing.
Explicit URI-list and CSV export with an unencrypted-secret warning, plus a versioned authenticated encrypted backup using PBKDF2-SHA-256 and AES-256-GCM.
Bounded CBOR, clientDataJSON, authenticator-data and attestation-object inspection, including flags, RP ID hash, counter, AAGUID, credential ID, COSE key and extensions.
Layered assertion verification for challenge, origin, cross-origin state, RP ID hash, user presence/verification, signature counter, and ES256, RS256, PS256 or Ed25519 signatures.
Layered registration verification for none, packed/self, FIDO U2F, TPM 2.0, Android Key and Apple anonymous attestation, including certificate signatures and format-specific credential/challenge bindings.
Explicit offline FIDO Metadata Service v3 JWT snapshot import, signer verification, AAGUID matching and authenticator status display. Imported metadata never silently establishes a trust root.
Serializable registration/request option examples, browser capability diagnostics and an ephemeral in-memory live ceremony lab.

Security boundary

The Toolbox app at /apps/auth/ is deliberately inspect-only for live WebAuthn ceremonies. Every app under toolbox.add-ideas.de shares one browser origin and therefore one WebAuthn relying-party namespace. Credential creation/authentication is enabled only on localhost or the dedicated origin:

https://auth.toolbox.add-ideas.de/

The same immutable release can be served there, top-level, with RP ID auth.toolbox.add-ideas.de. The RP ID is never widened to add-ideas.de, and arbitrary RP IDs can only be inspected offline.

Raw CTAP/token administration is not claimed: browsers expose ordinary WebAuthn but block the FIDO HID usage page from WebHID. Camera and USB permissions are not requested. QR images can be selected locally in current browsers; provisioning text can always be pasted.

See SECURITY.md for the threat model and limitations.

Develop and verify

Requirements: Node.js 22+, npm 11, and zip for deterministic release packaging.

npm ci
npm run check
npm run test:browser
npm run package:release

The Vite base is relative, so both / and nested paths work. npm run toolbox:check validates the built manifest and its assets.

Static deployment

Serve dist/ or the contents of release/auth-tools-0.2.0.zip over HTTPS. Recommended response headers:

Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'
Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=()
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin

For Portal integration, pin the immutable Gitea release ZIP and SHA-256 in toolbox-portal/release/toolbox.lock.json with target auth.

Deliberate limits

This is an engineering and interoperability workbench, not a certified authenticator, relying-party server, password manager, FIDO certification tool or recovery system.
Live credentials are forgotten on reload and cannot be exported by WebAuthn design.
Attestation cryptography and metadata status are evidence, not automatic device trust. No trust root or policy is bundled, and FIDO metadata is never downloaded silently.
All parts of a Google multi-QR batch must be supplied. Google migration export, Aegis password-vault decryption, FreeOTP 2.x encrypted XML and encrypted PSKC decryption are not claimed.
CSV and URI exports contain raw OTP seeds. The encrypted export is a portable backup file, not a persistent browser vault or recovery service.
QR generation supports byte-mode error-correction M through version 10. Larger provisioning records remain available as text exports.

Licence

GPL-3.0-or-later. See LICENSE, SOURCE.md, and THIRD_PARTY_NOTICES.md.