Time based One Time Passwords (TOTP)

What is Time based One Time Passwords (TOTP)?

Time based One Time Passwords (TOTP) is a method that gives you short, expiring codes to confirm a login. Your phone and the service both know a shared secret and the current time, so they independently arrive at the same six digit code. Picture a locker combo that keeps changing while you watch, yes, it is that simple.

How Time based One Time Passwords (TOTP) works

Here is the flow when you switch it on for an exchange or wallet login.

1. Start: In security settings, you choose the option for an authenticator app and scan the QR code.
2. Secret: Your app stores a shared seed, often called a secret key, that pairs your device with the service.
3. Sync: Both sides read the same clock in short time slices and run the standard math to make a six digit code.
4. Enter: At sign in you type the code before the timer rolls over.
5. Verify: The service checks the code with the same math and lets you in if it matches.

Yep, that is it.

Why Time based One Time Passwords (TOTP) Matters

Answer the “so what” in plain terms:

• Benefit: It stops many account takeovers even if someone knows your password.
• Perspective: SMS codes can be weak due to SIM swaps, so TOTP is a stronger second step. Most services let you enable two factor authentication 2FA with an authenticator app.
• Relevance: You will meet it on exchanges, NFT markets, DeFi dashboards, and custody portals.

Key Characteristics of Time based One Time Passwords (TOTP)

Quick traits worth knowing:

• Expiry: Codes last about thirty seconds, then they change.
• Offline: Once set, your app creates codes without internet.
• Shared: Both sides depend on the same secret stored at setup.
• Open: Based on a public RFC, which is why many apps support it.

How is Time based One Time Passwords (TOTP) calculated?

Under the hood, TOTP uses a one way function with time as input. You do not need to do this by hand, but here is the idea:

TOTP code = Truncate(HMAC SHA 1(secret, counter)) mod 10^digits
counter = floor(unix time in seconds divided by step)
step = 30 and digits = 6 in most apps

Variations

Main flavors you will see:

• HOTP: A counter based code that advances on each use, not tied to time.
• Push: An app prompt you approve, a cousin to TOTP with no code typing.
• Hardware: A small token that shows codes on a screen or key fob.
• Multi: Apps that store many accounts and backup options for recovery.

Example

You log in to a crypto exchange, enter your password, then open your authenticator app to type a six digit Time based One Time Passwords (TOTP) that expires in thirty seconds.

Fun Fact

TOTP was standardized in RFC 6238 by the OATH community, and it is the quiet backbone behind Google Authenticator and many other apps. Rolex meets Reddit threads, but for login codes.

Wrap-Up

Think of TOTP as a tiny time synced lock that makes your sign in harder to steal and easy to use.