TOTP (time-based one-time password)

A one-time code generated on your device from a shared secret and the current time, used by authenticator apps like Google Authenticator.

TOTP codes are computed locally. The service and your authenticator app share a secret at setup, and both derive the same six-digit code from that secret plus the clock, rotating every 30 seconds by default.

No SMS is involved, so there is no message to intercept, no carrier to filter it, and no cost per code. The algorithm is public and published as an internet standard, which is why one app works across thousands of services.

How the shared secret gets onto your phone

At setup the service shows a QR code that encodes a random secret, the account name and the issuer. Your authenticator reads it and stores the secret on the device. From then on both sides run the same calculation over the secret and the current 30-second time step.

Screenshot that QR code or save the text version somewhere safe before you finish. Restoring an authenticator on a new phone without it means falling back to recovery codes, which is where people get stranded.

Why clock drift breaks codes

Because the code is derived from time, a phone whose clock has drifted by more than a minute will generate codes the server rejects. Turning on automatic time sync fixes it, and most servers accept the neighbouring step to allow for small differences.

For accounts created with a rented number, TOTP is the natural second factor, since it removes the phone number from the account entirely. The guides for Discord and Instagram end with that step for the same reason.