What is TOTP? How authenticator apps generate 2FA codes

If you've ever opened an authenticator app and seen a 6-digit code that changes every 30 seconds, you've used TOTP — Time-based One-Time Password. It's the open standard behind two-factor authentication (2FA) on most modern services.

How TOTP works

When you turn on 2FA and scan a QR code, the service shares a secret key with your authenticator app. From then on, both sides run the same math:

1. Take the shared secret.
2. Take the current time, rounded to a 30-second window.
3. Combine them with a hash function to produce a 6-digit code.

Because both your app and the server know the secret and the time, they generate the same code independently — no internet connection required. That's why MS Authenticator App works offline.

Why TOTP beats SMS

SMS codes travel over the phone network, where they can be intercepted or redirected with a SIM-swap attack. TOTP codes never leave your device, so there's nothing to intercept.

Getting started

Turning on TOTP takes about a minute. See our step-by-step guides for popular services like Google, GitHub, and Coinbase, or browse all guides.