How TOTP 2FA Works: RFC 6238, HMAC-SHA1, and Secret Keys

Time-Based One-Time Passwords (TOTP, defined in RFC 6238) provide a standardized two-factor authentication mechanism implemented by apps like Google Authenticator, Authy, and 1Password.

Generate and test TOTP codes with our free TOTP / 2FA Generator.

How the TOTP Algorithm Computes Codes

1. Shared Secret: A base32-encoded cryptographic secret key shared between server and client.
2. Current Time Step: The current Unix epoch time divided by the step window (default 30 seconds): $$T = \lfloor \frac{\text{current Unix time}}{30} \rfloor$$
3. HMAC Computation: Computes an HMAC-SHA1 hash using the secret key and the time counter $T$.
4. Dynamic Truncation: Extracts a 4-byte dynamic binary code and takes the modulo $10^6$ to produce a 6-digit numeric token.

otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example

Verify secret keys and generate codes in your browser using the TOTP / 2FA Generator.