THE AUTHENTICATOR HANDBOOK

How TOTP codes work

A TOTP generator and the service checking it use a shared secret and time-based settings to calculate matching codes.

The ingredients must match

The key, algorithm, code length, and time settings must agree. Changing a setting in your generator does not change it on the service.

The timer is a guide

A common setup uses a 30-second step. The service decides which time windows to accept and whether a submitted code has already been used.

Why time matters

A device with an incorrect clock can calculate a code for the wrong window. Changing its displayed time zone alone should not change the underlying Unix time used by a correct implementation.

A practical check

Use a test key to compare tools, or check your account’s setup instructions. Never post a live setup key or full QR image when asking for help.

References