What is TOTP (Time-based One-Time Password)?
TOTP is the 6-digit code your authenticator app shows for 2FA. Learn how time-based one-time passwords work, and generate or verify one free.
TOTP — Time-based One-Time Password — is the standard behind the rotating 6-digit codes in Google Authenticator, Authy, and 1Password. It is defined by RFC 6238 and is the most common second factor for two-factor authentication (2FA).
How TOTP works
The server and your app share a secret (a Base32 string) once, at setup. Every 30 seconds both sides take the current Unix time, divide it by the 30-second step, and run HMAC-SHA1 over that counter with the shared secret. The result is truncated to 6 digits. Because both sides use the same secret and the same clock, they compute the same code without ever talking to each other — TOTP works fully offline.
Why the code changes every 30 seconds
The time step (default 30s) is what makes the password one-time: a code is only valid for its window, so a stolen code is useless moments later. Servers usually accept the previous and next window too, to tolerate small clock drift between your phone and their server.
TOTP vs SMS codes
TOTP never travels over the network, so it cannot be intercepted, SIM-swapped, or delayed like an SMS OTP. It is stronger than SMS for account security — though SMS OTP is still required by many services for phone verification, which is what our number API is for.
Try it now — free, no signup
Use the TOTP generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.