How TOTP two-factor authentication works

TOTP (time-based one-time password) is defined in RFC 6238. You and the service share a secret. Every 30 seconds both sides run the same math on “current Unix time divided by 30” and get the same 6-digit code. That is why 2fakey can replace an authenticator app for a pasted secret.

The shared secret

Issuers show the secret as Base32 (letters A–Z and digits 2–7). That encoding is what you paste into Google Authenticator, Authy, or this site. You can convert values with the Base32 encoder or mint a new key with the secret generator.

Time windows

Default period is 30 seconds. If your phone clock is wrong, codes drift. Servers usually accept the previous and next window. The verifier uses that ±1 step window.

Defaults you will see in the wild

• Algorithm: SHA-1 (still the Google Authenticator default)
• Digits: 6
• Period: 30 seconds

When you enroll an app, many sites also give an otpauth://totp/ link. Build one with the URI builder.