In this article
When you turn on two-factor authentication, a site shows you a QR code. You scan it once with an authenticator app, and from then on the app displays a six-digit number that changes twice a minute. You type it in, and you are let through. The app never talks to the site. So how do both sides arrive at the same number? The answer is a small, elegant recipe called TOTP.
The two ingredients
TOTP, defined in an open standard (RFC 6238), needs only two things that both sides already have: a secret key and the clock. The secret is a random string chosen by the server when you set up 2FA. The QR code you scan is just that secret, plus a label for the account, written in a way the app can read. The app stores it and the server stores it. That is the only moment the secret travels.
The clock is the second ingredient. Phones and servers keep time closely synchronised through the internet, so both can agree on “what time is it now” to within a second or two without talking to each other.
- Stored the secret when you scanned the QR
- Reads the current time from the phone
- Works with no signal at all
- Stored the same secret for your account
- Reads the current time from the server
- Computes the code it expects and compares
Same inputs on both sides give the same output. That is why the app works in airplane mode.
From time to a counter
The first step is to turn the time into a whole number that changes only every 30 seconds. Take the Unix time (the seconds since 1 January 1970; see Unix time explained) and divide by 30, dropping the fraction. The result is the counter.
| Unix time | Counter | Same code as the first? |
|---|---|---|
| 1,700,000,010 | 56,666,667 | Yes (start) |
| 1,700,000,039 | 56,666,667 | Yes (29 s later) |
| 1,700,000,040 | 56,666,668 | No, a new code |
The ringed cell is the first second of the next step. Every moment inside a step gives the same counter, so the code stays steady for 30 seconds.
- 0 sA new code appearsThe counter just ticked up, so the app computes a fresh code.
- 15 sHalfwayThe same code is shown. You have comfortable time to type it.
- 25 sTime is shortMany apps show the ring turning red. Wait for the next code if you are slow.
- 30 sNext stepThe counter becomes N + 1 and the old code stops being the current one.
From counter and secret to six digits
Now the counter and the secret are mixed using HMAC, a keyed hash (the idea is explained in what a hash is). A hash scrambles its input so thoroughly that even a tiny change gives a completely different output, and HMAC adds the secret so that only someone who knows it can produce the same result. The output is a long block of bytes, much too long to type.
So the standard shrinks it with a step called dynamic truncation: look at the last byte, use its low four bits as a starting position, take four bytes from that position, drop the top bit, and read them as a number. Finally take that number modulo 1,000,000 (the remainder after dividing) to get exactly six digits, padding with zeros at the front if needed.
- 1Read the clockUnix time, for example 1,700,000,010.
- 2Make the counterDivide by 30 and drop the fraction: 56,666,667.
- 3Mix with the secretRun HMAC over the counter using the shared secret (SHA-1 by default in most apps).
- 4TruncatePick four bytes from a position chosen by the last byte of the result.
- 5Keep six digitsTake the number modulo 1,000,000 and pad with leading zeros.
You never need to do this by hand. The point is that every step is public and repeatable, and only the secret is private.
How safe is a six-digit code?
There are only 1,000,000 possible six-digit codes, so a blind guess has a 1 in a million chance. That sounds weak, and by itself it would be, but the code is never the only barrier. It works together with a password, and servers limit attempts. Because clocks drift slightly, servers usually accept the previous, current and next step, so three codes are valid at once: the odds of a lucky guess become about 3 in a million.
Real services lock the account or slow down after a handful of wrong codes, so an attacker cannot simply try hundreds of thousands of codes.
TOTP is a strong everyday layer, not a perfect one. Hardware keys and passkeys, which are tied to the real site address, resist phishing better.
TOTP, SMS codes and passkeys
Text-message codes are easy to use but depend on your phone number, which can be hijacked through SIM-swap fraud or intercepted, and on the network being available. TOTP codes are generated on your device and need no signal. Passkeys and hardware security keys go further by cryptographically tying the login to the site, so a copied page cannot trick you.
| Method | Works offline | Hard to phish | Easy to set up |
|---|---|---|---|
| SMS code | No | No | Very easy |
| Authenticator app (TOTP) | Yes | No | Easy |
| Passkey or hardware key | Yes | Yes | Moderate |
Darker means the stronger or easier result in that column. This is a simplified overview: individual services implement each method differently.
None of these is useless. Any second factor is far better than none, because most account takeovers rely on a stolen or guessed password. If you can choose, use an authenticator app over SMS and a passkey over an app. For the password side of the equation, see password entropy.
Practical habits
- Save the recovery codes when you set up 2FA, and keep them somewhere other than your phone.
- Back up the secret if your app offers encrypted backup, or note the setup key in a password manager.
- Keep your phone’s clock automatic. If the codes are rejected, a wrong clock is the first thing to check.
- Never share the code, even with someone who says they are from support. A valid code is a key to your account for 30 seconds.
- Check the address bar before typing a code into any site.
The cleverness of TOTP is how little it needs: one secret, shared once, and the clock that is already on every device. Try the generator above with a test secret and watch the code change at the 30-second mark. It is the same maths protecting accounts all over the internet.
Questions people ask
What does TOTP stand for?
Time-based One-Time Password. It generates a short code from a shared secret and the current time, defined in RFC 6238.
How does the app know the code without internet?
The app and the server share a secret and both use the clock. They each compute the same code independently, so no connection is needed at login time.
Why does the code change every 30 seconds?
The time is divided into 30-second steps and the code is derived from the step number. When the step number changes, so does the code.
Why does my code say it is invalid?
The most common cause is a wrong phone clock. Turn on automatic date and time. Also check that you typed the current code, not the one that just expired.
Is an authenticator app safer than SMS?
Generally yes. App codes are generated on your device and cannot be intercepted through your phone number. Neither one stops a real-time phishing page.
What happens if I lose my phone?
You need your recovery codes or a backup of the secret to get back in. Save these when you enable 2FA, and keep them away from the phone.