RandomKeyGenerator.com

Home / Guides / How TOTP Works

How TOTP Works

Every 30 seconds, your authenticator app shows a new 6-digit code that somehow matches what the server expects, without the two ever talking to each other at that moment. Here's the actual mechanism.

The short version

TOTP (Time-based One-Time Password, RFC 6238) works because both your app and the server already share a secret, exchanged once, at setup, usually via a QR code. From that point on, neither side needs to communicate to agree on the current code: both independently combine the shared secret with the current time, run it through the same math, and arrive at the same 6-digit number. If someone steals a single code, it's useless within 30 seconds, and unlike a password, the secret itself is never transmitted after setup.

The actual steps

  1. Setup: the service generates a random secret (typically 160 bits, Base32-encoded so it's easy to type or scan as a QR code) and shares it with your app.
  2. Time counter: both sides compute the same number by dividing the current Unix time by the step size (almost always 30 seconds) and rounding down, so this number only changes once per 30-second window.
  3. HMAC: the secret and the time counter are combined using HMAC, almost universally HMAC-SHA1 for compatibility, though SHA-256 and SHA-512 are supported by the standard.
  4. Truncation: the HMAC output (a long hash) is reduced down to a short number using a defined truncation method (RFC 4226 §5.3), then taken modulo 106 to produce the familiar 6-digit code.

Run this same process independently on both ends with the same secret and the same (roughly synchronized) clock, and you get the same code. No network round-trip required at the moment of generation.

TOTP vs. HOTP

HOTP (HMAC-based One-Time Password, RFC 4226) is TOTP's predecessor and uses the same core mechanism, but with an incrementing counter instead of the current time. It's less common today because it requires both sides to stay in sync on how many codes have been generated. TOTP's time-based approach sidesteps that by using something both sides already agree on: the clock.

Try it yourself

Generate a TOTP secret and watch the code change every 30 seconds on the TOTP / 2FA panel of the main generator. It implements exactly the algorithm described above.

Frequently asked questions

Why doesn't my 2FA code match what the app is asking for?

The most common cause is clock drift. TOTP relies on your device's clock being accurate to within about 30 seconds of the server's. If your device's time is out of sync (common on some phones after a restart, or in a VM), the code your app shows won't match. Re-syncing your device's clock usually fixes it.

Is TOTP the same as the 6-digit code in an SMS text?

No. An SMS code is generated by the server and sent to you over the phone network, which can be intercepted via SIM-swapping attacks. A TOTP code is generated locally on your device from a shared secret, with nothing transmitted at generation time, which is why security guidance generally recommends authenticator apps over SMS for two-factor authentication.

Sources: