What TOTP Means in Plain English
TOTP stands for Time-Based One-Time Password. Defined by the open IETF standard RFC 6238, it is the mechanism powering the rotating 6-digit (or 8-digit) verification codes inside authenticator apps across GitHub, Google, AWS, Shopify, Microsoft, and banking portals.
Unlike a text message code sent across a telecom network, a TOTP code is never transmitted to you during login. Instead, your authenticator app and the service's authentication server independently calculate the same temporary number at the exact same moment using a shared secret key and the current UTC time.
How Time-Based One-Time Passwords Work
Every TOTP setup follows a two-phase lifecycle—an initial enrollment handshake and ongoing offline verification:
- Setup Handshake: When you turn on 2FA inside an account, the server generates a random secret key (usually 16 to 32 Base32 characters) and encodes it inside an otpauth:// QR code.
- Local Key Storage: You scan or import that QR code into an authenticator app or Chrome extension. Both the server and your device now store the identical secret key.
- Time Window Calculation: At login time, your authenticator takes the current Unix time in UTC seconds and divides it by the configured period (almost always 30 seconds, occasionally 60 seconds).
- Cryptographic Truncation: An HMAC function (HMAC-SHA1, HMAC-SHA256, or HMAC-SHA512) hashes the shared key with that integer time step and extracts a 6-digit or 8-digit number.
SharedSecret = "JBSWY3DPEHPK3PXP" (stored once during setup) TimeStep = floor(CurrentUnixUTC / 30) OTPCode = Truncate(HMAC_SHA1(SharedSecret, TimeStep)) mod 10^6
Want to inspect algorithm parameters and SHA variants in detail? Review our engineering breakdown of RFC 6238 TOTP generation and supported hash lengths.
Why TOTP Codes Expire Every 30 Seconds
Short expiration windows limit the blast radius of shoulder surfing, phishing interception, and compromised logs. Because each passcode stays valid only for its active 30-second slice (plus a tiny server-side tolerance window of +/- 1 step to forgive minor clock skew), capturing a single code gives an attacker almost no window to reuse it later—and many servers strictly invalidate each code once used.
Because TOTP uses UTC time rather than internet lookups, your phone or PC clock must stay within ~30 seconds of real network time. If codes stop working offline, verify your system's automatic time synchronization.
How TOTP Differs From Static Passwords
| Property | Static Password | TOTP Code (RFC 6238) |
|---|---|---|
| Lifespan | Valid indefinitely until manually changed | Rotates automatically every 30s or 60s |
| Exposure Risk | Reused leaks compromise multiple websites | Single code expires quickly and proves key possession |
| Offline Creation | Memorized or recalled from a password vault | Computed locally offline from secret + system clock |
| Role in Security | Knowledge factor (something you know) | Possession factor (access to device holding seed) |
If you prefer generating these codes without picking up a mobile phone, read how an offline authenticator in Chrome computes matching codes locally inside your desktop browser.
