How TOTP Authenticator Apps Work?

Time-based One-Time Password (TOTP) serves as a crucial element in two-factor authentication, providing a temporary passcode to verify a user's identity during login. Unlike SMS codes, TOTP does not depend on network connectivity, as both the user's device and the login server independently generate the same code at the same moment.

The mechanism of TOTP is grounded in two shared pieces of information: a secret key known only to the user's device and the server, and the current universal time. These components enable the user's phone and the server to produce matching codes without direct communication.

Upon initial setup, the server generates a unique secret key, displayed to the user as a QR code that the authenticator app scans and stores securely within the device. After this initial exchange, no further network interaction is needed between the app and the server.

The code generation process unfolds in three steps:

1. Time discretization - The current Unix time is divided by an interval of 30 seconds, yielding a counter value that remains constant for the entire 30-second block.

2. Cryptographic hashing - The counter and the secret key undergo HMAC function processing, generating a 160-bit hash that is computationally infeasible to reverse or predict.

3. Truncation - The hash is shortened to a 6-digit number by extracting a portion of the output, reducing it, and applying the modulo operation.

During verification, the server performs the same calculation using its clock and the user's saved secret key. To accommodate potential clock discrepancies, the server generates codes for the present time, the preceding window, and the following window, creating a 60-second safety margin.