TOTP: what it is (codes that change every 30 seconds)
TOTP is the standard authenticator apps use to generate a different code every 30 seconds, from a secret stored on your device and the current time.
- What it is
- Code that changes every 30s
- Since
- 2011 (RFC 6238)
- Verdict
- Yes
What it is
TOTP stands for "Time-based One-Time Password." When you turn on two-step verification with an authenticator app, that app and the service share a secret. From that secret and the current time, both calculate the same 6-digit code, which expires and changes every 30 seconds.
No internet connection or signal is needed: the calculation happens on your own device. That's why it's immune to SMS interception or SIM duplication, but it depends entirely on you keeping that secret.
Since when
The IETF, the organization that defines internet's technical standards, published TOTP as RFC 6238 in May 2011. It's an evolution of HOTP (RFC 4226, from 2005), which used a counter instead of the clock as the variable for calculating the code.
Why it's used
It's used because it's more resilient than SMS: the code doesn't travel over any network someone could intercept or redirect, and it doesn't depend on your phone number or your carrier.
The flip side: the secret that generates those codes lives on your device. If you lose it without having saved a copy, or without using an app that offers one, you also lose the ability to generate those codes for every account you protected that way.
Do we use it?
Yes, it's the recommended standard, always with a backup. Without a copy of the secret somewhere else, TOTP becomes just another single point of failure inside your phone.
Check this
- Do you have a backup of your TOTP secrets in more than one place?
- Do you know if your authenticator app backs up to the cloud or only lives on this phone?
- Do you have the backup codes for the accounts you protect with TOTP?
Official source: RFC 6238, TOTP: Time-Based One-Time Password Algorithm (IETF)