Two-Factor Codes Explained: How TOTP Authenticator Apps Work
Security · October 18, 2026 · 2 min read
When a site asks for a six-digit code from an app, it's using a time-based one-time password, or TOTP. The code proves you hold something only you should have, which is a phone or an app with a secret in it.
How a code is made
The site and your app share a secret key when you set up two-factor sign-in. Each 30 seconds, both take the current time, work out which 30 second step it falls in, and mix the step number with the secret using a keyed hash (HMAC). They cut a six-digit number out of the result. Because both sides have the same secret and the same clock, they get the same code, and nothing is sent between them. This is a public standard, RFC 6238, so any authenticator app works with any site that uses it.
The secret key
The secret is usually shown as a string of capital letters and the digits 2 to 7. That's Base32, chosen because it's easy to read and type without mixing up characters. You can look at how that encoding works with the Base32 Encoder. Whoever has the secret can make your codes, so keep it as private as a password.
Setting one up
Most sites show a QR code. It holds an otpauth link with the secret, the account name and the settings. Scanning it saves you from typing. The TOTP Generator shows the live code for any secret, and also makes a link and a QR code from a secret, which is handy for testing a login system you're building. Learn how those codes are built in the guide to QR codes.
Why a code sometimes fails
- The clock on your phone is wrong. Turn on automatic time.
- You typed the code just as it changed. Wait for the next one.
- The site uses different settings, such as 8 digits or a 60 second step. A scanned QR code handles this for you.
- You're using the wrong account's entry in the app.
Keeping it safe
Save the backup codes the site gives you, and keep the secret in a real authenticator app or password manager. Don't paste a secret you care about into a web page you don't control, and close this page when you're done.