What is TOTP (time-based one-time password)?

The six-digit code an authenticator app generates from a shared secret and the current time, refreshing every 30 seconds.

Every exchange that offers app-based two-factor authentication is using this scheme. When you scan a QR code during setup you are copying a secret into the app. From then on the app and the exchange compute the same code independently from that secret and the clock, with nothing passing between them, which is why the codes still work with the phone in airplane mode.

The common mistake is treating the app as the thing being protected rather than the secret behind it. Wipe the phone with no record of that secret and the codes are gone.

How it works

TOTP is defined in RFC 6238, which builds on the HMAC-based one-time password construction in RFC 4226. The exchange generates a random secret and shows it to you as a QR code and as a string of characters. Both sides then take the current Unix time, divide it by a fixed time step to get a counter, and compute a keyed hash of that counter using the shared secret.

The hash is truncated to a short decimal number. RFC 6238 gives 30 seconds as the recommended default time step, and six digits is the common length, which is why nearly every authenticator shows a six-digit code on a 30-second timer. Servers generally also accept the code from the adjacent step to tolerate clock drift.

Two consequences follow. The code cannot be intercepted in transit, because it never travels anywhere until you type it. And anyone who obtains the setup secret, from a screenshot, an unencrypted cloud backup, or a phishing page that captures it during enrollment, can generate valid codes forever without ever touching your phone.

Example

Illustrative: your phone reads 12:00:07 and the app shows 418233 with 23 seconds left on the ring. The exchange, computing from the same secret and the same 30-second window, expects 418233 as well, so the login succeeds. At 12:00:30 both sides roll to a new value.

Now suppose your phone's clock has drifted two minutes fast. Your app is computing a window the server has not reached, every code is rejected, and the fix is to re-sync the phone's time rather than to reset the account.

Why it matters when you buy

Account takeover is the failure that costs buyers the most, and it usually starts with a password reused from somewhere else. Turning on app-based codes and a withdrawal whitelist before you fund an account is worth more than any fee difference between venues, and the exchange directory shows which security features each one supports. The guide on two-factor authentication for crypto walks through enrollment and backup.

Related terms

• two factor authentication: the broader category TOTP belongs to
• passkey: a phishing-resistant alternative to codes
• sim swap: why text message codes are weaker
• withdrawal whitelist: limits damage if login is breached
• phishing: how setup secrets and codes get captured

Questions

Is an authenticator app safer than a text message code?

Yes. A text message can be redirected by a carrier-level attack on your phone number, while a TOTP secret never leaves the device it was enrolled on. Regulators and exchanges both treat app-based codes as the stronger option.

Can I put the same secret in two devices?

Usually yes, because the secret is just data and any compliant app can compute from it. Enrolling a second device during setup is a reasonable backup, though it doubles the number of places the secret can leak from.

What happens if I lose my phone?

You use the backup codes the exchange issued at enrollment. Without them you must pass the exchange's account recovery process, which normally means re-verifying your identity and waiting out a security hold before withdrawals reopen.