How Two-Factor Authentication (2FA) and TOTP Codes Work

Where the 6-digit codes in authenticator apps come from, how they differ from SMS, and why backup codes matter. A practical guide to protecting your accounts.

Being asked for a 6-digit code from your phone after your password is the best-known form of two-factor authentication (2FA). Even if your password leaks, an attacker still has to get past this second step. This guide explains where those codes come from and how to set up 2FA properly.

Where do the codes come from?

Apps such as Google Authenticator and Microsoft Authenticator use an open standard called TOTP (time-based one-time password). The QR code you scan when linking an account contains a secret key. The app combines that key with the current time and produces a new code every 30 seconds. The server has the same key, calculates the same code on its side and compares them. No internet connection is needed; the phone's clock just has to be right.

SMS or an app?

A code sent by text message is still a second factor and far better than nothing. But SMS can be intercepted, for example when a number is moved to another SIM card (SIM swapping). An authenticator app is generally considered safer because the key stays on your phone. Where supported, hardware security keys and passkeys are stronger still.

What not to skip during setup

Keep the backup codes. Most services give you single-use backup codes when you turn on 2FA. If you lose your phone, these get you back in. Store them in a password manager or somewhere safe offline.
Move your accounts before changing phones. Use the authenticator app's transfer feature before wiping the old phone, or set 2FA up again on the new phone for each account.
Start with the most important accounts. Your email account comes first, because it is the password-reset route for everything else. Then banking, cloud storage and social media.

Nobody should ask for your code

If someone claiming to be your bank, a delivery company or a support team asks for a verification code over the phone, it is a scam. Real services do not ask you to read the code out. Only type it into a login you started yourself, after checking the address of the site.

What the TOTP code generator is for

Our TOTP code generator calculates the current 6-digit code from a Base32 secret key in your browser. It suits developers testing 2FA in their own apps, or anyone curious to see how the standard works. Do not paste the secret keys of your real accounts into any website; for everyday use, the authenticator app on your phone is the right place.