Every time you open Google Authenticator and see a 6-digit code changing every 30 seconds, you're watching TOTP in action. Here's exactly how it works.
In This Guide
What TOTP Stands For
TOTP stands for Time-based One-Time Password. It's an open standard (RFC 6238) used by Google Authenticator, Authy, Microsoft Authenticator, and virtually every other 2FA app.
How TOTP Codes Are Generated
A TOTP code is calculated from two inputs:
- A shared secret key — a random string given to you when you scan a QR code during 2FA setup
- The current Unix timestamp — divided into 30-second windows
The algorithm combines these using HMAC-SHA1 to produce a 6-digit number. Because both your device and the server know the same secret and use the same clock, they independently produce the same code — without ever transmitting it over the network.
The Secret Key
The secret key is a Base32-encoded string — typically 16–32 characters like JBSWY3DPEHPK3PXP. It's what a QR code encodes. The key is established once, at setup, and never changes. It's the single most sensitive piece of information in your 2FA configuration — whoever has it can generate all your future codes.
Why TOTP Is Secure
- The code changes every 30 seconds — a stolen code is useless moments after capture
- The secret key never travels over the network — unlike SMS codes
- Works offline — no server contact needed to generate a code
- Open standard — independently reviewed and proven
Limitations of TOTP
- Phishable — a fake login page can capture your TOTP code and use it in real-time (unlike hardware keys)
- Time-dependent — if your device clock drifts, codes will be wrong
- Secret key must be stored securely — if your authenticator app backup is compromised, all 2FA tokens are compromised
The Mathematics Behind TOTP
TOTP is built on HMAC (Hash-based Message Authentication Code). The algorithm takes two inputs: your secret key and the current time interval (the number of 30-second periods since January 1, 1970, calculated as floor(Unix_timestamp / 30)). It feeds these into HMAC-SHA1, producing a hash. A portion of this hash is then extracted and converted to a 6-digit decimal number. The process is deterministic — the same secret key and the same time interval always produce the same code — which is why both your app and the server can independently generate identical codes.
Why Codes Change Every 30 Seconds
The 30-second window is a deliberate security design. A short enough window means a code intercepted by an attacker becomes useless very quickly. But it needs to be long enough to be practical — if codes expired after 5 seconds, users would constantly miss the window. The TOTP standard (RFC 6238) specifies 30 seconds as the default period, though some services use 60 seconds.
How the Server Verifies Your Code
When you enter a code at sign-in, the server runs the same TOTP calculation using the secret key it stored when you set up 2FA, and the current time on its end. If the result matches your input, authentication succeeds. To account for minor clock differences and network latency, most servers accept codes from one window before and after the current one — a 90-second total window. If your code is further out of sync than this, authentication fails even if your code was mathematically correct for your clock's current time.
TOTP vs HOTP
TOTP is derived from HOTP (HMAC-based One-Time Password, RFC 4226). The difference is the counter input: HOTP uses an incrementing counter (each code generated advances the counter), while TOTP uses the current time. TOTP is more commonly used today because time-based sync is simpler than counter synchronisation — there is no state to track between the client and server beyond the shared secret and a reliable clock.
What Happens When You Lose the Secret Key
The secret key is the seed for all code generation. If you delete your authenticator app entry without saving the key, and you do not have backup codes, you lose the ability to generate valid codes for that account. The service has no way to regenerate the same secret — they would need to give you a new one by resetting 2FA entirely, which usually requires identity verification. This is why some password managers offer to store both the password and the TOTP secret for an account together, ensuring you always have the seed available.
TOTP and Passkeys: What Comes Next
Passkeys — device-bound cryptographic credentials that replace passwords and OTP codes — are being adopted by Google, Apple, and Microsoft, and some services already treat them as a 2FA replacement. TOTP will not disappear overnight: it remains the most universally supported second factor, works entirely offline, and requires no special hardware. Expect a long transition period in which passkeys, hardware keys, and TOTP coexist, with TOTP remaining the pragmatic default for most accounts for years to come.
Anatomy of a TOTP Setup URI
When you scan a QR code, your app is actually reading a small text string called a setup URI. It looks like this: otpauth://totp/Coinbase:alex@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Coinbase. The secret parameter is the Base32 key everything hinges on; the label before the colon is the issuer, and the part after it is the account name the app displays.
Understanding the URI is useful because it explains what the QR code really does: it transfers the secret key from the service to your app. That is why services tell you to scan only from your own logged-in settings page — a QR code sent by email or pasted into a chat is simply the secret being handed to whoever reads it.
The label is also worth a moment of care: it is what appears in your app, and a vague label like "new account" becomes impossible to distinguish once you hold several entries from the same service. If your app lets you rename an entry, use the service name plus your username (for example, "GitHub: alex") so you always know which code belongs where.
TOTP App Comparison: Backup and Sync Tradeoffs
- Google Authenticator — free and widely trusted; codes are stored locally, with optional encrypted cloud sync since 2023
- Authy — automatic cloud backup of encrypted tokens; requires a master backup password and a phone number
- Microsoft Authenticator — cloud backup tied to your Microsoft account; also handles push approvals
- 1Password / Bitwarden — TOTP secrets stored inside your vault, restored on any device; convenience comes at the cost of a single vault to protect
- Ente Auth / Aegis — privacy-focused options with encrypted exports and no account required
Whichever you choose, the deciding question is the same: if this phone vanished today, how would you regenerate the codes on a replacement device? Every app above answers that question differently, and "I would start from scratch" is not a viable answer once the app holds codes for ten or more services.
Should You Store TOTP Secrets in a Password Manager?
Storing the TOTP secret next to the password means one master password unlocks both factors, which on paper violates the spirit of two-factor authentication. In practice, security experts accept this tradeoff: the alternative — a second app with its own backup and its own failure modes — is where most people lose access. If you use a reputable password manager with strong master-password hygiene, having the TOTP code beside the password rarely changes your real-world risk.
If the idea of a single point of failure bothers you, split the difference: keep TOTP codes in the password manager for low-stakes accounts, and keep email, banking and crypto codes in a separate authenticator app with its own backup enabled.
Five TOTP Myths, Debunked
"My codes are generated by my phone number." They are not. The code is computed from the secret key and the time; your phone number plays no role, which is precisely why TOTP survives a SIM swap.
"A code I type once can be reused." No — each code belongs to a specific 30-second window that moves on, so an old code is never accepted again.
"TOTP codes are sent over the internet." They are generated locally and never transmitted; only the number you type travels to the server.
"A longer secret key means a longer code." Not usually. The code length is fixed by the service (normally 6 digits); a longer secret only makes guessing harder, not the code longer.
"TOTP stops phishing." It stops credential theft and SIM swapping, but a real-time phishing proxy can relay your code within its window — which is why high-value accounts deserve a hardware key or passkey.