TOTP
also: Time-based One-Time Password, RFC 6238
Time-based One-Time Password (TOTP) is a two-factor authentication method that generates a unique 6-digit code that changes every 30 seconds based on the current time and a shared secret key.
TOTP is a standardized algorithm (RFC 6238) for generating temporary authentication codes without requiring a server connection. The code is produced by a device or app using only the current time and a secret key shared during setup, making it work offline.
When you enable TOTP on a service (like GitHub or AWS), you scan a QR code with an authenticator app (Google Authenticator, Authy, etc.) to store the secret. Your phone generates a new 6-digit code every 30 seconds; you enter this code along with your password to log in.
Example: A secret key generates code 847261 at 14:30:00, which becomes invalid at 14:30:30 when the app generates 392514. Even if someone sees your code, it expires in seconds and is useless without the secret key.
TOTP is more secure than SMS-based 2FA because it's not vulnerable to SIM swaps or phone number hijacking, and it works even without cellular service.