TOTP Explained: How Time-Based One-Time Passwords Secure Your Accounts (And the Best Apps to Use)

In a world where data breaches and password leaks are routine, relying on a username and password alone is no longer enough. Two-factor authentication (2FA) has become essential, and one of the most reliable methods is TOTPm Time-based One-Time Password.

Unlike SMS codes that can be intercepted or delayed, TOTP generates short-lived codes right on your device. It’s free, works offline, and is supported by virtually every major service. Here’s everything you need to know.

What Is TOTP?

TOTP stands for Time-based One-Time Password. It is an open standard (defined in RFC 6238) that generates a temporary numeric code, usually 6 digits, that changes every 30 seconds (sometimes 60).

These codes are created by an authenticator app on your phone (or computer) using a shared secret key and the current time. Both your device and the service you’re logging into calculate the same code independently. No internet connection is required after the initial setup.

TOTP is a form of software-based 2FA (sometimes called “app-based authentication” or “soft tokens”). It is widely used by Google, Microsoft, GitHub, banks, crypto exchanges, password managers, and thousands of other services.

How TOTP Works (Step by Step)

The process is elegant and doesn’t require constant communication between your phone and the server:

1. Setup / Enrollment
   When you enable 2FA on a website or app, the service generates a random secret key (usually 160 bits or more) and displays it as a QR code (or a manual key).
   You scan the QR code with an authenticator app. The app stores the secret securely. The service also stores the same secret linked to your account.

2. Code Generation
   Every 30 seconds, both the app and the server do the same calculation:

   • Take the current Unix timestamp and divide it by 30 (the time step).
   • Feed that time counter + the shared secret into an HMAC cryptographic function (usually HMAC-SHA1, though SHA-256/512 are also supported).
   • Truncate the result into a 6-digit (or sometimes 8-digit) code.

3. Verification
   You enter the code shown in your app. The server performs the identical calculation. If the codes match (and the server usually allows a small window of ±1 time step to account for slight clock differences), you’re authenticated.

Because the code is tied to time and expires quickly, even if someone sees or steals one code, it becomes useless within seconds.