How authenticator app codes really work (and why they beat SMS)

Authenticator apps show a six-digit code that changes every 30 seconds, and they work even in flight mode. That isn't magic: it's a standard called TOTP (time-based one-time password).

What happens when you scan the QR code

The QR code contains a random secret. Your app saves it, and so does the website. From then on, both sides can make the same codes without ever talking to each other.

How a code is made

1. Take the current time and divide it into 30-second steps.
2. Mix the step number with the secret using HMAC, a keyed hash (see encryption and hashing).
3. Turn part of the result into a six-digit number.

Try it yourself with a demo secret in the TOTP / 2FA code simulator and watch the code change as the timer runs out.

Why it beats SMS

SMS codes travel over the phone network, so they can be stolen by SIM-swap fraud or intercepted. TOTP codes are made on your device and never sent anywhere.

Its weak spots

• A fake login page can still trick you into typing a code, and the attacker uses it straight away.
• Anyone who copies the secret can make valid codes forever, so protect your backups.

For admin and high-value accounts, go one step further with passkeys or security keys, which can't be phished. Read strong passwords and MFA for the full picture.