TOTP meaning
TOTP means time-based one-time password. It creates a short numeric code from a shared setup secret and the current time, so the code changes as time moves forward.
What is TOTP?
TOTP is the time-based one-time password method used by many authenticator apps and account security systems. This guide explains the terms behind 2FA, MFA, OTP, Base32 setup keys, otpauth links, algorithms, digits, and the usual 30-second refresh cycle.
How a TOTP code is generated
A TOTP generator decodes the setup secret, divides the current Unix time into time steps, applies an HMAC algorithm such as SHA-1, SHA-256, or SHA-512, then truncates the result into the configured number of digits.
RFC 6238 formula and time-step counter
RFC 6238 defines the counter as T = floor((UnixTime - T0) / X). With the common T0 value 0 and 30-second step X, the service and authenticator independently encode T as an 8-byte big-endian counter and calculate HMAC with the same shared key K. Matching K, T0, X, algorithm, and digit count produces the same code for the same time step.
Dynamic truncation and zero padding
The HOTP step used by TOTP takes the low four bits of the final HMAC byte as an offset, reads four bytes from that position, clears the sign bit to obtain a 31-bit positive integer, then applies modulo 10^digits. The decimal result is left-padded with zeros, so a six-digit code can legitimately begin with zero.
Clock accuracy and verification windows
TOTP does not send the current code between the authenticator and service before login; both sides calculate it from their clocks. A verifier may allow a limited adjacent time-step window for ordinary clock drift, but each additional accepted window extends how long a captured code may work, so the window should remain narrow.
Why time zones do not change TOTP
The formula uses Unix time rather than a displayed local time zone. Changing only the time-zone label should not change a TOTP code, while an incorrect system clock can move the counter into a different time step and cause a valid setup key to produce a rejected code.
TOTP security limits and phishing
TOTP adds a separate factor beyond a password, but it is not phishing-resistant. An attacker can relay a current code in real time, and anyone who obtains the shared setup secret can calculate future codes. Protect setup keys and recovery codes, verify the sign-in origin, and prefer passkeys or hardware security keys when a service offers phishing-resistant authentication.
TOTP, OTP, 2FA, and MFA
OTP is the broad category of one-time passwords. TOTP is the time-based version. 2FA uses two authentication factors, while MFA can use two or more factors. A TOTP code is often used as one factor in 2FA or MFA.
Base32 setup keys
Manual authenticator setup keys are commonly written in Base32 using A-Z and 2-7, often with spaces for readability. The spaces are display formatting; the TOTP calculation uses the normalized key bytes.
otpauth links and QR codes
Many QR codes contain an otpauth://totp/ URI. That link can include the account label, issuer, secret, algorithm, digits, and period, which lets compatible authenticator tools configure the generator accurately.
Local browser generation
This site can generate authenticator-style TOTP codes locally from a Base32 secret or otpauth URI. For URL shortcuts, the fragment form such as #secret=YOUR_BASE32_SECRET is preferred because it is not sent in the HTTP request.
TOTP algorithm parameter quick reference
A standard TOTP code combines the shared secret with a time-step counter, then applies HMAC and dynamic truncation. This table summarizes the values most authenticator apps expect.
| Parameter | Purpose in TOTP | Common value |
|---|---|---|
| Shared secret / Base32 setup key | Private value known by the service and the authenticator, used to generate each code. | Required |
| Time step / period | The length of each code window; commonly calculated from Unix time divided by the period. | 30 seconds |
| HMAC algorithm | The hash algorithm used before dynamic truncation. | SHA-1 |
| Code length | The number of digits shown after the modulo step. | 6 digits |
| Issuer and account label | Display metadata inside an otpauth URI; it does not change the TOTP calculation. | Optional |
Standards and references
- RFC 6238: TOTP: Time-Based One-Time Password Algorithm
- RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm
- NIST SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management
FAQ
Is TOTP the same as a 2FA code?
Not exactly. TOTP is one method for producing an OTP. Many services use a TOTP code as the second factor in 2FA, so people often call the generated TOTP value a 2FA code.
Why does a TOTP code usually change every 30 seconds?
The TOTP algorithm uses time steps, and 30 seconds is the common default. A shorter step can be less forgiving, while a longer step keeps each code valid for more time.
Can a TOTP code be generated without the setup secret?
No. A valid TOTP code requires the shared setup secret plus matching parameters such as time period, algorithm, and digit count. Without the secret, the correct code cannot be calculated.
What is the safest URL format for a TOTP shortcut?
Use a fragment shortcut such as #secret=YOUR_BASE32_SECRET. Fragments stay in the browser and are not sent to the server, unlike path and query values.
Does the device time zone affect a TOTP code?
No. TOTP uses Unix time, not the displayed time-zone label. The device clock still needs to be accurate because a clock that is ahead or behind can select the wrong time-step counter.
Is Base32 part of the TOTP calculation?
Base32 is a readable encoding used to provision the shared secret. The generator first decodes it into key bytes; HMAC, the time-step counter, dynamic truncation, and the digit modulo produce the TOTP value.
Is TOTP phishing-resistant?
No. A phishing site can relay a still-valid TOTP code, and a copied setup secret can generate future codes. Passkeys and hardware security keys can provide phishing-resistant authentication when the account provider supports them.