Two-factor authentication and TOTP
How the six-digit codes in authenticator apps work: the shared secret behind the QR code, HMAC and the 30-second clock, a working TOTP implementation, verifying codes safely, backup codes, and how TOTP compares with SMS and passkeys.
CodexBash, , 5 min read
A password alone is one leaked database away from being useless. Two-factor authentication (2FA) adds a second proof, something you have, so a stolen password is not enough. The most common second factor is the six-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy, which changes every thirty seconds. It looks like magic, since the app works offline, but it is a short, elegant algorithm called TOTP. This article explains it and builds it.
Sign in to read the rest
The whole 5 minute article is free with an account, along with every problem, lesson and tutorial. No card.