TOTP

TOTP, or Time-based One-Time Password, is a mechanism used to provide a short-lived numeric code as a second factor in authentication. It is defined as part of the HOTP family by RFCs 4226 and 6238, where a secret key is shared between a server and a client, typically stored in an authenticator app on a mobile device.

The secret is provisioned to the client by scanning a QR code or entering a base32 string. The code is generated locally by computing an HMAC of the current time-based counter with the shared secret, and then truncating to a fixed number of digits, usually six. The counter is derived by dividing the current Unix time (minus a reference time T0) by a time step, commonly 30 seconds. The same algorithm is implemented on the server, which verifies user-provided codes by computing TOTP values for the current and nearby time steps to tolerate small clock drift.

Because TOTPs are valid only for a short window, they do not require the server to receive the code over the network for verification; the verification is a local computation, then the server checks if the code matches. This reduces susceptibility to interception but does not fully prevent phishing, since an attacker could prompt a user to supply a valid code. TOTPs are widely deployed for two-factor authentication across services, often used with apps like Google Authenticator, Authy, or other authenticator apps.

Security considerations include protecting the shared secret, ensuring time synchronization between client and server, and providing recovery options such as backup codes or account recovery flows.