Generate and verify RFC-compatible one-time passwords from a Base32 secret, then build an otpauth URI without sending credentials anywhere.
Compare the generated value with your implementation using a disposable test secret. Clock drift, secret storage, recovery codes, rate limits, and account recovery still require server-side controls.