Two-Factor CodesHow TOTP codes work
The code in your authenticator app is not sent from anywhere. Your phone and the website both calculate it from a shared secret and the time.
The idea
When you set up two-step sign-in with an app, the site gives your app a secret (a long random value, usually shown as a QR code or as letters and digits in Base32). Both sides keep that secret. After that, no message passes between them to make a code: each side calculates it, using the same recipe and the same clock.
The recipe
The recipe is the HOTP algorithm of RFC 4226 with the counter replaced by the time (RFC 6238):
- The counter T = the number of time steps since 1 January 1970 UTC. With the usual step of 30 seconds, T is the Unix time divided by 30, rounded down.
- HMAC. Calculate HMAC-SHA-1 (RFC 6238 also allows SHA-256 and SHA-512) of T, written as 8 bytes, using the secret as key.
- Dynamic truncation. Use the last 4 bits of the result as an offset, take 4 bytes from there, and clear the top bit.
- Shorten. Divide by 10 to the power of the number of digits and keep the remainder.
A calculation you can follow
Here it is for the test secret 12345678901234567890 and the counter 0. These are the same values that RFC 4226 prints in its Appendix D (the 20-byte HMAC value, the 4 bytes and the number 1284755224), and we also calculated them with Python:
| Step | Value for our example (secret 12345678901234567890, counter 0) |
|---|---|
| 1. Counter as 8 bytes | 0000000000000000 |
| 2. HMAC-SHA-1 of the counter, key = secret | cc93cf18508d94934c64b65d8ba7667fb7cde4b0 |
3. Offset = last 4 bits of the last byte (b0 and 0f) | 0 |
| 4. Take 4 bytes from that offset | cc93cf18 |
| 5. Clear the top bit, read as a number | 1284755224 |
| 6. Keep the last 6 digits (the number modulo 1,000,000) | 755224 |
The answer, 755224, is the first code in the RFC's list. For TOTP, the counter is the time step instead of 0, but nothing else changes.
Why the codes change every 30 seconds
The counter is the time step, so when the clock moves into the next 30-second window the counter changes and a completely different HMAC comes out. Nobody can predict the next code without the secret.
What the code is not
It is not a secret that proves who you are by itself. Anyone who has the secret can make your codes, which is why the QR code shown when you set up two-step sign-in must be kept private. A code can also be typed by you into a fake website, which then uses it at once: this is called phishing, and one-time codes do not stop it (NIST says OTP authentication is not phishing-resistant).
Why do apps show 6 digits?
RFC 4226 says the value must be at least 6 digits. 6 is the common choice because it is easy to type. Some systems use 7 or 8.
Do I need the internet for the code?
No. The phone only needs a correct clock.
Sources
- RFC 4226: HOTP (rfc-editor.org/rfc/rfc4226), including Appendix D
- RFC 6238: TOTP (rfc-editor.org/rfc/rfc6238)
- NIST SP 800-63B-4 (pages.nist.gov/800-63-4/sp800-63b.html)
Read on 14 November 2026.
This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.