How TOTP-Based 2FA Actually Works Under the Hood
Time-based one-time passwords are just a shared secret plus the current time, run through HMAC. Here's the whole mechanism.
The whole algorithm in one paragraph
TOTP (RFC 6238) takes a shared secret, the current Unix time divided into 30-second windows, and runs them through HMAC-SHA1 to produce a 6-digit code. Both your phone and the server compute the same code independently because they share the secret and (roughly) agree on the time — no network round trip needed.
Why it's more secure than SMS 2FA
SMS codes can be intercepted via SIM-swapping or SS7 attacks. TOTP never touches the network during verification — the code is generated locally on the device, which closes off an entire class of interception attacks.
- Clock drift is why servers usually accept the previous and next 30s window too
- The secret is shared once at enrollment (usually via QR code) and never transmitted again
- Losing the device means losing access — always provide backup codes at enrollment
- Google Authenticator, Authy, and 1Password all implement the same RFC, so they're interchangeable
Try it on code.live
code.live's TOTP generator lets you paste a secret and watch the 6-digit code roll over in real time — handy for testing a 2FA integration without switching to your phone every 30 seconds.
Key takeaways
- Apply one concrete change from this post before collecting more reading.
- Prefer browser-side tools when the work involves secrets, tokens, or PII.
- Document the why next to the how so the next reviewer inherits context.
FAQ
- Who is this guide on security for?
- Working developers who need a practical take on how totp-based 2fa actually works under the hood — not a marketing overview. Skim the sections, apply one tip, then come back when you hit an edge case.
- Do I need an account to use the related tools?
- No. code.live tools run in your browser with no signup. Nothing you paste is uploaded to a server for the client-side utilities linked from this post.
- How often is this article updated?
- This post was published August 16, 2026. Fundamentals stay stable; check linked tool pages and official docs when version-specific behavior matters.