TOTP

TOTP (Time-based One-Time Password) is an algorithm that generates short-lived, rotating numeric codes used as a second factor in authentication. It is the technology behind authenticator apps that display a six-digit code changing every 30 seconds. Entering that code in addition to a password proves you also hold the device, making stolen credentials alone insufficient to log in.

How TOTP works

When you enable two-factor authentication, the service and your authenticator app share a secret key, usually exchanged by scanning a QR code. From then on, both sides independently compute the same code by combining that shared secret with the current time, rounded to a fixed interval. Because both use the same inputs, the codes match without any communication — the app works even offline. When the time window advances, a new code is generated and the old one stops being valid.

Why TOTP improves security

TOTP defends against a large class of attacks. A password captured through phishing, a breach or a brute-force attack is not enough on its own, because the attacker also needs the current time-based code, which changes constantly and never leaves the user's device in a reusable form. Unlike codes sent by SMS, TOTP does not depend on the mobile network and cannot be intercepted through it. TOTP is a standardised, open algorithm, so it is supported by many services and apps and is often exposed through an API for integration. As with all authentication, the surrounding connection must be protected by HTTPS so codes cannot be observed in transit. While not perfectly immune to real-time phishing, TOTP is a simple, widely available and highly effective upgrade over passwords alone.