How OTP Codes Actually Work (And Why They Expire So Fast)
Open a banking app or an authenticator app and it shows you six digits that change every thirty seconds, whether you're looking at the screen or not. There's something faintly magical about it the first time you notice: the app on your phone and the server on the other side of the world have never exchanged a message about this specific code, and yet if you type it in, it works. Then thirty seconds later it doesn't.
An OTP app and a server share a secret set up once, during enrolment. Both sides independently combine that secret with the current time to calculate the same six-digit code, without ever transmitting it. This is TOTP, defined in RFC 6238. Because nothing is sent over the network, there's nothing for an attacker to intercept.
How does an OTP app calculate the code without contacting a server?
The standard behind most authenticator apps is called TOTP, Time-based One-Time Password, defined in RFC 6238. The idea is simpler than the name suggests. When you first set up two-factor authentication, your device and the service's server agree on a shared secret, usually handed over once as a QR code during setup. From that point on, neither side ever needs to send the code anywhere. Instead, both sides independently combine that shared secret with the current time, run it through a cryptographic hash, and chop the result down to six digits. Because both sides have the same secret and both sides are looking at, roughly, the same clock, they arrive at the identical number without ever having to compare notes.
The "roughly the same clock" part is why the window is thirty seconds rather than, say, one second. Clocks drift a little between devices, and thirty seconds gives enough tolerance that a phone that's a few seconds fast or slow still lands in the same time bucket as the server. Most implementations also accept the code from one window either side, to cover a phone whose clock has drifted more than expected, which is why an OTP occasionally still works a few seconds after you'd expect it to have expired.
Why is this more secure than a code sent by SMS?
SMS codes work differently, and it's worth knowing why security teams have spent the last decade quietly nudging people away from them. An SMS code has to be generated somewhere and transmitted to your phone, which means it exists, briefly, as a message travelling across a telecom network that wasn't really built with modern security threats in mind. SIM-swap attacks exploit exactly this: convince a phone carrier to move your number to a new SIM card, and the "second factor" that was supposed to prove it's really you now goes straight to an attacker instead.
A TOTP code generated on-device never has that problem because it's never transmitted at all. There's no message to intercept, no carrier network in the loop, nothing to redirect. The only way to get the code is to already have the secret, and the secret only ever lived on your device and the server since the day you scanned that setup QR code.
What is HOTP and how is it different?
There's a sibling standard called HOTP (HMAC-based One-Time Password) that works almost identically but swaps time for a counter. Instead of "what six digits correspond to this 30-second window", it asks "what six digits correspond to the next number in this sequence". You'll find HOTP inside a lot of physical hardware security keys and some bank card readers, devices that don't necessarily have an accurate internal clock but can reliably count "this button has now been pressed for the 214th time". Each use advances the counter by one, on both the device and the server, so they stay in step the same way TOTP's two clocks stay in step.
What do people get wrong about OTPs?
The most common mistake isn't technical, it's behavioural: treating an OTP like a password you can reuse or share. An OTP that someone reads out to you over the phone claiming to be "IT support" is functionally identical to handing over your password, because for the thirty seconds it's valid, it is your credential. Legitimate support staff never need you to read a one-time code back to them.
The second mistake is on the building side rather than the using side: storing the shared secret in plain text, or logging it somewhere it shouldn't be. The entire security model rests on that secret staying secret. If a database of TOTP seeds ever leaks, every account tied to it needs to be re-enrolled from scratch, because the six-digit code was never really the secret, it was just the visible output of one.
Testing and demoing OTP flows
If you're building or testing a login flow that expects a one-time code and you need sample codes without wiring up a full authenticator, the OTP generator on this site will produce properly formatted numeric codes on demand, entirely in your browser. It won't replicate the actual TOTP math against a real shared secret, but for UI testing, screenshots, documentation and demo environments where you just need something that looks and behaves like a real one-time code, it does the job without you needing to stand up an authentication server first.
Frequently Asked Questions
How does an OTP app know the right code without an internet connection?
It never needs to check with a server in real time. During setup, your device and the server agreed on a shared secret. From then on, both sides independently combine that secret with the current time to calculate the same six digits, with no network round trip required.
Why does an OTP expire after 30 seconds?
Thirty seconds is the width of the time window used in the TOTP standard (RFC 6238). It's short enough that an intercepted code becomes useless almost immediately, but long enough to tolerate small clock drift between your device and the server.
Is an SMS code the same thing as a TOTP code?
No. An SMS code has to be generated and transmitted over a telecom network, which creates a window for interception or SIM-swap attacks. A TOTP code is calculated independently on both ends and never travels anywhere, so there's nothing to intercept.
What's the difference between TOTP and HOTP?
TOTP derives the code from the current time. HOTP derives it from a counter that increments by one each time the code is used. HOTP is common in hardware security keys that lack an accurate internal clock.
Can someone steal my account if they see my OTP code?
Only within that thirty-second window, and only if they also have your password. Treat a spoken or shared OTP the same as you would a password: legitimate support staff never need you to read one out to them.
What happens if a service's TOTP secret gets leaked?
Every account using that secret needs to be re-enrolled in two-factor authentication from scratch. The six-digit code was never the actual secret, it was just the visible output of one, so once the underlying secret is exposed the whole scheme is broken for that account.