TOTP and 2FA: how time-based codes work
Two-factor authentication (2FA) asks for something beyond your password when you log in. TOTP — time-based one-time password — is the mechanism behind authenticator apps: a six-digit code that changes every thirty seconds and is valid only for that short window.
Why use two-factor authentication?
Passwords leak: phishing pages, reused credentials and data breaches expose them daily. A stolen password is useless when the attacker also needs the six-digit code that exists only on your phone at the moment of login. That single extra factor blocks most account takeovers.
TOTP codes are generated offline on your device and never travel over the network until you enter them, which makes them harder to intercept than codes sent by SMS.
- 2FA turns a stolen password alone into a failed login.
- TOTP works offline and does not depend on a carrier.
- Codes rotate every 30 seconds and expire quickly.
How is the code computed?
Your phone and the server share a secret key, usually given as a Base32 string when you scan a QR code. The key is combined with the current 30-second time window and signed with the one-way HMAC-SHA1 algorithm. The signature is truncated into a six-digit number — the code you type.
Because time is part of the input, both sides generate the same number only during the same few seconds. Any drift, like a wrong phone clock, breaks the match until it is corrected.
Generate codes for testing with FreetoolsY
The TOTP Generator lets you paste a Base32 secret and see the current six-digit code live. It is handy for testing keys you created yourself, recovering access during development, or simply understanding how the algorithm behaves.
- Paste the Base32 secret key into the tool.
- Read the current six-digit code and the countdown to the next one.
- Only use secrets you trust — treat keys like passwords.