TOTP stands for time-based one-time password. It is the technology behind many six-digit codes displayed by authenticator apps. A TOTP code is calculated from a private setup key and the current time, then expires after a short interval.

TOTP is commonly used as the second step in two-factor authentication. It can work without a mobile signal because the authenticator calculates the code locally instead of waiting for a message.

What information creates a TOTP code?

Two inputs matter: a shared secret and a time counter. The account provider creates a secret during setup and gives it to your authenticator through a QR code or manual key. Both sides then divide time into equal windows and perform the same cryptographic calculation.

If the secret, algorithm, and time window match, both sides produce the same short code. The secret itself does not need to be transmitted during each login.

Four-stage TOTP process from secret and time to code validation
The authenticator and service independently calculate a value from the same secret and time window.

How does TOTP work?

  1. The provider creates a unique secret for the authenticator enrollment.
  2. You scan the setup QR code or enter the manual secret on a trusted device.
  3. The authenticator combines the secret with the current time window.
  4. The result is reduced to a short numeric code, commonly six digits.
  5. The provider calculates its expected code and compares it with your entry.

RFC 6238 defines TOTP as a time-based variation of HOTP. A common configuration uses a 30-second period, six digits, and HMAC-SHA-1, although other supported algorithms and settings exist.

Why do TOTP codes expire?

A short validity period limits how long a copied code can be reused. Once the time window changes, the authenticator produces another value. Services may tolerate a nearby window to account for network delay and small clock differences, but broader tolerance also increases the acceptance window.

Enter a new code near the beginning of its countdown. If codes are rejected consistently, follow our guide for fixing a 2FA code that is not working.

TOTP versus HOTP

TOTP and HOTP use related calculations but advance differently:

  • TOTP changes according to a time step, so authenticator clocks must be synchronized.
  • HOTP changes when a counter advances, such as after a button press or successful use.

TOTP is common in software authenticator apps because time supplies an automatic moving factor. HOTP is still used by some hardware tokens and specialized systems.

TOTP versus SMS codes

A TOTP app calculates codes on the device and normally works offline. SMS relies on the telephone network to deliver a code. SMS is convenient but can be affected by SIM swaps, number reassignment, interception, and delivery failures.

Neither ordinary TOTP nor SMS is fully phishing-resistant: a convincing fake sign-in page can capture and relay a current code. For important accounts, a passkey or FIDO security key is generally stronger where supported. See our detailed comparison of authenticator apps versus SMS.

What is a TOTP secret?

The secret is the long-lived credential behind all future codes for that enrollment. Anyone with it can configure another authenticator and generate matching values. A screenshot of the setup QR code is sensitive because it normally contains that secret.

Our guide explains where to find the manual 2FA setup key and how to distinguish it from a password or recovery code.

Can TOTP work offline?

Yes. Once configured, an authenticator needs the secret and an accurate clock, not an active internet connection. The service verifying the login still needs access to its stored enrollment information.

How to use a TOTP generator safely

  • Use only secrets belonging to accounts you are authorized to manage.
  • Verify the website address and device before entering a secret.
  • Never send a secret or setup QR code through chat or support forms.
  • Keep recovery codes separately from the everyday authenticator.
  • Regenerate the enrollment if the secret may have been exposed.

For authorized testing, the Get2FA.dev TOTP generator calculates standard codes in your browser. For daily use on important accounts, prefer a reputable authenticator or hardware-backed method.

Frequently asked questions

How long does a TOTP code last?

Thirty seconds is a common default, but the provider can configure another period. The countdown belongs to a time window; it is not restarted when you view or copy the code.

Why are TOTP codes usually six digits?

Six digits balance usability with a limited number of possible values. Rate limits and short validity windows are important because the code space alone is not large.

Can two devices show the same TOTP code?

Yes, if both hold the same secret, use the same settings, and have synchronized clocks. Whether duplicating an enrollment is appropriate depends on your security policy.

Is TOTP the same as 2FA?

No. TOTP is one possible authentication method. Read what 2FA means and how its other methods work.