---
title: "TOTP"
description: "TOTP is a time-based one-time password used in two-factor authentication apps. See how the rotating 6-digit codes are generated and why they add security."
url: "https://nodea.io/en/glossary/totp"
lang: "en"
updated: "2026-07-13"
---

# TOTP

> TOTP (Time-based One-Time Password) is an algorithm that generates short-lived, rotating one-time codes used as a second factor in authentication.

**TOTP** (Time-based One-Time Password) is an algorithm that generates short-lived, rotating numeric codes used as a second factor in authentication. It is the technology behind authenticator apps that display a six-digit code changing every 30 seconds. Entering that code in addition to a password proves you also hold the device, making stolen credentials alone insufficient to log in.

## How TOTP works

When you enable two-factor authentication, the service and your authenticator app share a secret key, usually exchanged by scanning a QR code. From then on, both sides independently compute the same code by combining that shared secret with the current time, rounded to a fixed interval. Because both use the same inputs, the codes match without any communication — the app works even offline. When the time window advances, a new code is generated and the old one stops being valid.

## Why TOTP improves security

TOTP defends against a large class of attacks. A password captured through phishing, a breach or a [brute-force attack](https://nodea.io/en/glossary/brute-force-attack) is not enough on its own, because the attacker also needs the current time-based code, which changes constantly and never leaves the user's device in a reusable form. Unlike codes sent by SMS, TOTP does not depend on the mobile network and cannot be intercepted through it. TOTP is a standardised, open algorithm, so it is supported by many services and apps and is often exposed through an [API](https://nodea.io/en/glossary/api) for integration. As with all authentication, the surrounding connection must be protected by [HTTPS](https://nodea.io/en/glossary/https) so codes cannot be observed in transit. While not perfectly immune to real-time phishing, TOTP is a simple, widely available and highly effective upgrade over passwords alone.

### Why does the TOTP code change every 30 seconds?

Because the code is derived from the current time and a shared secret. Rotating it frequently means a stolen code is useless within seconds, sharply limiting the window an attacker has to reuse it.

## Related

- [Brute force](https://nodea.io/en/glossary/brute-force-attack)
- [HTTPS](https://nodea.io/en/glossary/https)
- [VPN](https://nodea.io/en/glossary/vpn)
- [API](https://nodea.io/en/glossary/api)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/totp.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)