By Alex Carter, Editor at GetVerifyCode
A time-based one-time password (TOTP) is a short code, usually 6 digits, that an authenticator app or hardware token works out from a shared secret and the current time. A new code appears every 30 seconds by default, and it never travels by text message. You type it as the second step when you sign in.
Key facts
- RFC 6238, an Informational IETF document, describes TOTP as the time-based version of HOTP from RFC 4226.
- RFC 6238 recommends a default time step of 30 seconds, counted from the Unix epoch.
- The app or token and the service share a secret key. HMAC-SHA-1 is the default function, and SHA-256 or SHA-512 are also allowed.
- RFC 6238 recommends that a service accept at most one earlier time step to allow for network delay, which is why a wrong device clock can break codes.
How the TOTP algorithm works
Nothing is sent to you. Your device and the service each work the code out on their own, in four steps.
- When you turn on app-based two-factor sign-in, the service creates a secret key and shows it to you, usually as a QR code. Your authenticator app saves it.
- Your app and the service each take the current time and count how many 30-second steps have passed since January 1, 1970. That count is the moving part.
- Each side runs the secret and that count through a keyed hash function (HMAC) and trims the result down to a short number, usually 6 digits.
- When you type the code, the service compares it with the one it worked out. If they match inside the allowed window, the sign-in goes through.
Because the code depends on both the secret and the clock, a code someone saw a minute ago is already stale, and the next one is designed to be unpredictable without the secret. HOTP, its older cousin, moves forward on a counter instead of the clock.
What is a one time password token?
A one time password token is whatever holds the secret and generates the codes. There are two kinds.
- Hardware token: a small key fob or card with a screen, which some employers and banks hand out. It shows a new code on its display.
- Soft token: an authenticator app on your phone or computer, such as Google Authenticator. It stores a separate secret for each account and shows a rolling code for each one.
Either way, the token is the thing you have, and your password is the thing you know. Together they make two-factor authentication, which our guide to two-factor vs two-step verification explains in more detail.
TOTP vs SMS codes
Both give you a short one-time code, but they reach you in different ways. For the wider picture, see what OTP means and what a verification code is.
- TOTP (authenticator app or token): made on your own device, no text message, works offline, changes every 30 seconds by default, best for accounts you keep long term.
- SMS code: sent by the service to your phone number as a text, needs mobile signal, usually valid for a few minutes, best when a service only offers SMS or for a quick sign-up check.
- Backup codes: saved once when you set up two-factor sign-in, each one works a single time, best as a fallback if you lose the device that holds your authenticator.
If a site asks for a 6-digit code from an authentication app and you can't find it, read how to get a verification code without a phone.
Why TOTP codes fail: clock drift
The service expects the code for the current 30-second step and, per RFC 6238, should accept at most one earlier step for delay. If your phone's clock has drifted further than that, every code it shows belongs to the wrong window.
- Turn on automatic date and time on your phone so it stays in sync with the network.
- Type the code before it refreshes. If the timer is nearly out, wait for the next code.
- Check you're using the entry for the right account, since each account in the app has its own secret.
- If the service still rejects the code, see our guide to verification code invalid or expired errors.
Can a temporary number help with TOTP?
No. TOTP codes are generated on your own device, so no phone number ever receives them, and GetVerifyCode can't supply them. A temporary number only helps when a service sends a one-time code by SMS, for example a sign-up you want to keep separate from your personal number for privacy, travel or testing your own app.
For those SMS codes, start on GetVerifyCode and pick the service, such as Google, WhatsApp or Telegram. Top up your wallet from $1. Each number is priced live per service and country. You see the quote before you confirm, and if no SMS arrives in about 20 minutes, the unused credit returns to your wallet. See pricing.
Some apps reject virtual numbers. Acceptance is decided by the app, not by us. Don't use a temporary number for banking or for accounts you plan to keep, because you can lose access to the number later. If an SMS code doesn't show up, try these fixes for a missing verification code.
Using a temporary number to protect your privacy, travel, or test your own app is generally lawful in many places, but laws differ by country and each app sets its own terms. Check both. Never use it for fraud, impersonation, or getting around a ban.
Related guides
- What Does OTP Mean? One-Time Passcodes Explained
- What Is a Verification Code? SMS Codes Explained
- What Is Two-Factor vs Two-Step Verification?
- How to Get a Verification Code Without a Phone
- Verification Code Invalid or Expired? How to Fix It
Need an SMS code instead? Get a temporary number on GetVerifyCode.
About the author: Alex Carter is the editor at GetVerifyCode. Alex tests SMS verification routes across services and countries and writes plain-language guides on receiving OTP codes safely.
GetVerifyCode is not affiliated with the apps named in this article. Follow each app's terms and local law.
FAQ
FAQ
TOTP stands for time-based one-time password. It's a short code, usually 6 digits, that an authenticator app or hardware token calculates from a secret it shares with a service and the current time. The code changes every 30 seconds by default, and the service checks it without anything being sent by text.
RFC 6238 recommends a 30-second time step, so most apps show a new code every 30 seconds. A service can choose a different step, and many accept the previous code for a short time to allow for delay.
It removes some risks. A TOTP code isn't sent over the phone network, so an intercepted text or a SIM swap doesn't expose it. It can still be phished if you type it into a fake page, so enter it only on the real site or app.
It's the device that holds the secret and produces the codes: either a small hardware token with a screen or an authenticator app on your phone, often called a soft token. You need it each time you sign in, so keep backup codes somewhere safe in case you lose it.
No. TOTP codes are generated on your own device, so they're never sent to a phone number. A temporary number can only receive codes that a service sends by SMS.
