How TOTP 6-digit codes actually work

TOTP stands for time-based one-time password. When you add an account, the service and your app agree on one shared secret. From then on, both sides mix that secret with the current time to produce the same 6-digit number — no network needed.

What that means in practice

• The code changes about every 30 seconds, so an intercepted one is useless almost immediately.
• Nothing is sent to your phone, so there's no message for an attacker to redirect.
• It works with no signal and no internet, because it's just maths on your device.
• Your device's clock has to be right — that's the one thing that breaks it.

Why it beats SMS

SMS codes travel over the phone network, where they can be intercepted or redirected with a SIM-swap attack. A TOTP code never leaves your device, which removes that whole category of attack.