Short answer: TOTP stands for Time-based One-Time Password. A TOTP code is a six-digit number your authenticator app calculates by combining a secret key — stored on your device when you scanned the setup QR code — with the current time, rounded to a 30-second window. The server holds the same secret and does the same calculation. When both answers match, you are let in. Nothing is transmitted, which is why the codes work in airplane mode.
The core idea: shared secret plus a shared clock
Most people assume the six digits are sent to their phone. They are not. Here is what actually happens.
When you enable two-factor authentication, the service generates a random secret key — typically 160 bits of randomness, displayed to you as a QR code or a string of letters and numbers. Your app stores it. The server stores it. That is the only time it is ever exchanged.
From then on, both sides have everything they need. Your phone takes the secret, takes the current Unix timestamp, divides that timestamp by 30 to get a counter, and runs both through a cryptographic hash function. The output is truncated down to six digits. The server, thirty milliseconds later on the other side of the world, performs the identical calculation and gets the identical answer.
No network. No SMS. No trust in a carrier. Just two calculators agreeing on the same maths.
Why the code changes every 30 seconds
The time counter increments once every 30 seconds, so the input to the hash changes, so the output changes. This is what makes the password “one-time” — a code intercepted at 10:00:15 is worthless by 10:00:45.
Thirty seconds is a compromise. Shorter windows would be more secure but frustrating to type. Longer windows would be easier to use but give an attacker more time to reuse a stolen code. The standard settled on 30, and nearly every service follows it.
Most servers also accept the previous window’s code, giving you a grace period of roughly a minute in practice. That is why a code sometimes still works just after the timer runs out.
The standard behind it
TOTP is defined in RFC 6238, published by the IETF in 2011. It builds on HOTP (RFC 4226), which used an incrementing counter instead of a clock.
Because it is an open, published standard, any app that implements it correctly produces identical codes. Google Authenticator, Authy, Microsoft Authenticator, Aegis, 1Password, Bitwarden — feed them the same secret and they will all show the same digits at the same moment. There is no proprietary magic and no lock-in at the protocol level. We compare how the apps differ in practice in our roundup of Google Authenticator alternatives.
What the QR code actually contains
That square you scan is not an image of your account. It encodes a plain-text URI that looks roughly like this:
otpauth://totp/GitHub:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=GitHub
The fields are simple: the account label, the issuer name shown in your app, and — critically — the secret. That secret is the whole ballgame.
Never screenshot a setup QR code and never store it in cloud photos. Anyone who obtains that image can generate your codes forever, silently, from anywhere in the world. You would have no way to know.
The one legitimate use for capturing it: scanning the same QR code into a second app as a deliberate backup, at setup time, before the service hides it. Pasting that secret into a web page is never safe, as we explain in our look at online 2FA code generators.
Why your codes sometimes get rejected
Nearly every “invalid code” complaint traces back to one cause: clock drift. If your phone’s clock is more than about 30 seconds off from the server’s, your calculation lands in the wrong time window and produces a different number.
The fix is always the same — enable automatic network time in your phone’s date and time settings. On Android, Google Authenticator also offers a Time correction for codes option that syncs its own internal offset without touching your system clock.
Less commonly, the issue is a mistyped code or a secret that was never saved correctly during setup. If a code is rejected consistently rather than intermittently, the enrolment itself probably failed and needs redoing.
What TOTP protects against — and what it doesn’t
It stops
- Password breaches. A leaked password alone is useless without the second factor.
- Credential stuffing. Automated attacks reusing passwords from other breaches simply fail.
- SIM swapping. No phone number is involved, so hijacking your number achieves nothing.
- Network interception. The code never crosses a network on its way to you.
It does not stop
- Real-time phishing. A fake login page can relay your code to the real site within its 30-second life. This is TOTP’s genuine weakness, and it is why passkeys and hardware keys — which bind logins to a specific domain — are considered stronger. Our comparison of SMS 2FA versus authenticator apps puts the full hierarchy in order.
- Malware on your device. If your phone is compromised, so are your codes.
- A leaked secret. If the QR code or secret string is exposed, every future code is predictable.
- Server-side breaches. If a service stores secrets poorly and is breached, attackers can generate codes for every affected user.
Frequently asked questions
Does TOTP work without internet?
Yes. Codes are computed locally from a stored secret and your device’s clock. Airplane mode, no signal, no Wi-Fi — the app still works. Only your login attempt itself needs connectivity.
Are TOTP codes random?
No. They are deterministic — the same secret and the same 30-second window always produce the same six digits. They look random because the underlying hash function makes the output unpredictable without the secret.
Can two people have the same code at once?
Yes, by coincidence. There are only a million possible six-digit values, so collisions across different accounts happen constantly. This does not weaken security, because a code is only ever checked against the specific secret for one account.
Can I use the same secret in two apps?
Yes. Scanning the same QR code into two apps gives you a redundant backup, and both will show matching codes. You must do this during initial setup — most services will not display the QR code again.
What is the difference between TOTP and HOTP?
HOTP uses a counter that advances each time a code is generated. TOTP uses the clock instead, so codes expire on their own. TOTP is the standard for authenticator apps; HOTP is mostly found in older hardware tokens.
Is TOTP the same as 2FA?
No. 2FA is the broader concept of requiring two proofs of identity. TOTP is one specific way to deliver the second proof, alongside SMS codes, push notifications, passkeys, and hardware keys. Our beginner’s guide to two-factor authentication covers the whole landscape.
The bottom line
TOTP is elegant precisely because it is boring: two devices, one shared secret, one shared clock, and no communication required. Understanding that the secret is the only thing worth protecting changes how you handle setup — you stop screenshotting QR codes, you start saving backup codes offline, and you stop worrying about whether your authenticator app has signal.
11 Responses