Module 11 · Human Verification
One-Time Passwords & Multi-Factor Authentication
This lab shows how OTP and MFA flows work in real applications. Practice a real TOTP authenticator, a controlled Email OTP environment built for deterministic automation, a live real-email delivery experience, and a realistic SMS simulation — then automate the same flows, including expiry, resend, and lockout.
Key Topics
1. TOTP Authenticator
A real, RFC 6238 time-based code derived from a shared secret and the current time — the same mechanism Google/Microsoft Authenticator use. Provision a secret, generate the current code, then verify it against a genuine backend.
Test Scenario
Provision a shared secret
Shared secret (Base32)
—
otpauth URI
—
—
A real authenticator app scans the QR code once, then generates a fresh 6-digit code every 30s from the secret alone — no network round-trip. This page won't show the secret again after you leave — treat it like a real shared secret.
Generate & verify a token
The compute button is a convenience so you can try it by hand — in a real test your script calls authenticator.generate(secret).
✓ TOTP verified
✗ Not verified
Current Execution
TOTPNo request executed yet — set up a secret to begin.
Status
Not run yet
Response body
Not run yet
2. Email OTP
Controlled Test EnvironmentA deterministic, controlled inbox for automation practice — this section attempts real email delivery when configured, and always keeps a simulated inbox as a guaranteed fallback. Request a code, retrieve it, and verify it against a genuine backend.
Test Scenario
Request a verification code
Retrieve the code
Open your simulated inbox and copy the 6-digit code — real email retrieval works the same way, just against your actual mailbox.
Inbox is empty — request a code, then fetch.
Enter & verify
✓ Code verified
A session token was issued:
—
✗ Not verified
Current Execution
EMAILNo request executed yet — send a code to begin.
Status
Not run yet
Response body
Not run yet
3. Real Email OTP — Live Experience
Manual · Real SMTPSend a real OTP through this platform's SMTP delivery, then retrieve it by hand from your actual inbox — the closest this lab gets to a live, real-world experience, without automating a personal mailbox.
Test Scenario
✉ Learning Note — Real Email vs Automation
REAL EMAIL
Application → OTP → SMTP → Your Inbox → You Read OTP
AUTOMATION
Test → OTP → Controlled Inbox → Playwright → Verify
Use Real Email to experience actual delivery. Use the controlled Email OTP section above for automation practice. See Learn More below ↓
Send a real verification email
Open your real mailbox
Check the inbox (and Spam folder) for the address above, then copy the 6-digit code. There's no "Fetch inbox" button here on purpose — reading your actual mailbox is the point of this section.
Enter & verify
✓ Code verified
A session token was issued:
—
✗ Not verified
Current Execution
REAL EMAILNo request executed yet — send a real email to begin.
Status
Not run yet
Response body
Not run yet
4. SMS OTP — Realistic Simulation
Realistic SimulationReal SMS delivery normally requires a paid provider (e.g. Twilio). This free lab uses a realistic SMS simulation so you can learn and automate the complete OTP lifecycle at no cost — deterministic, and free, same as Email OTP above.
Deterministic and free — the simulated gateway provides the same reliable OTP source for automation practice as Email OTP above.
Test Scenario
Send a verification SMS
Open the simulated message
Open the simulated SMS below and copy the 6-digit code — a real integration would poll your SMS provider's test-number API the same way.
Inbox is empty — request a code, then fetch.
Enter & verify
✓ Code verified
A session token was issued:
—
✗ Not verified
Current Execution
SMSNo request executed yet — send a code to begin.
Status
Not run yet
Response body
Not run yet