I was always amazed at these small devices. My dad uses these to log into his work laptop, I couldn't understand how can it generate a code without being connected to any network.

I fired up google and tried to search about it, and surprisingly it used a pretty amazing concept. It had a shared key with the server, and then it did some computation on the shared key and current UTC time to get a 6-digit number. So, the remote device just had to be accurate at timekeeping. It uses an algorithm called TOTP (Time based one time password), it's been standardized and there's no point in getting into the details, here's the standard if anyone wants to take a look. You can read this article on freecodecamp.org for a more layman-ish approach to the whole algorithm.

First Prototype

Coming back, so I decided to implement this using ESP32, because I had a devkit lying around, and the OLED and RTC libraries were solid, and I could use WiFi to get accurate time, which is absolutely need to generate the codes, here's a picture of the first prototype.

It worked fine, I used to generate a secret key from here, and then flash the esp32 with the new key and boom, it generated codes I wanted to (It was not as easy as it sounds, I had to spend days putting together a firmware to do it, and it was start of Covid-19 Lock down so I had a lot of free time).

Second Prototype

I wanted to take this to next level, make something like those RSA key id devices, but more configurable and not exactly use and throw like those and ESP32 was the right tool for it. So, I designed a PCB for the same. It was a long process, I had to handle my summer internship, finally by October I finished designing it and after getting it reviewed and rerouting again after two weeks, my PCB was ready to be ordered.

Final Design

After the second prototype I wanted to make it more sleek as the OLED was being used as a external module and it increased the height too much. So, I designed a new board, basically updated the board design by rerouting and optimizing it. You can see both designs and see the improvements.

https://www.freecodecamp.org/news/how-time-based-one-time-passwords-work-and-why-you-should-use-them-in-your-app-fdd2b9ed43c3/