{
  "id": 8439637,
  "title": "How TOTP Authenticator Apps Work?",
  "url": "https://urgent.news/2026/09/19/how-totp-authenticator-apps-work",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-19T10:33:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/biswasprasana001/how-totp-authenticator-apps-work-19bg"
  },
  "original_language": "en",
  "account": "Time-based One-Time Password (TOTP) serves as a crucial element in two-factor authentication, providing a temporary passcode to verify a user's identity during login. Unlike SMS codes, TOTP does not depend on network connectivity, as both the user's device and the login server independently generate the same code at the same moment.\n\nThe mechanism of TOTP is grounded in two shared pieces of information: a secret key known only to the user's device and the server, and the current universal time. These components enable the user's phone and the server to produce matching codes without direct communication.\n\nUpon initial setup, the server generates a unique secret key, displayed to the user as a QR code that the authenticator app scans and stores securely within the device. After this initial exchange, no further network interaction is needed between the app and the server.\n\nThe code generation process unfolds in three steps:\n1. Time discretization - The current Unix time is divided by an interval of 30 seconds, yielding a counter value that remains constant for the entire 30-second block.\n2. Cryptographic hashing - The counter and the secret key undergo HMAC function processing, generating a 160-bit hash that is computationally infeasible to reverse or predict.\n3. Truncation - The hash is shortened to a 6-digit number by extracting a portion of the output, reducing it, and applying the modulo operation.\n\nDuring verification, the server performs the same calculation using its clock and the user's saved secret key. To accommodate potential clock discrepancies, the server generates codes for the present time, the preceding window, and the following window, creating a 60-second safety margin.",
  "summary": "Time-based One-Time Password A Time-based One-Time Password ( TOTP ) is a temporary passcode (a secret number) used to confirm a person's identity when logging into a computer system. It forms part of two-factor authentication (a security check that asks for two different proofs of who you are, like a normal password plus a temporary number). Unlike text-message codes, TOTP does not require a…",
  "key_points": [
    "TOTP is a time-based two-factor authentication method",
    "Uses shared secret key and current time for code generation",
    "Three-step process: time discretization, cryptographic hashing, truncation"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}