Time Based One Time Passwords are short numeric codes that change every thirty seconds and are generated on your phone or a hardware device. They add a second check to your login, so a stolen password alone is not enough. Many banks, email providers and work systems now offer them as an option.
This article explains how these codes are created, what makes them hard to reuse, and where they fall short. It also covers practical setup steps, common errors such as clock drift, and how to protect the backup options that keep you from being locked out of your own accounts.
Why a Code That Changes Every Thirty Seconds Matters
Imagine you type a correct password on a laptop at a café, and a criminal has already captured that password through a fake website. Without a second check, the criminal can log in as you.
A code that changes over time gives that criminal a much smaller window, because the number shown on your phone stops working soon after it appears.
This is the core idea behind Time Based One Time Passwords, often abbreviated TOTP. The code is valid only for a short period and only once. Even if someone sees it, the number is useless a short while later, which makes stolen codes far less valuable than a stolen password.
Such codes are not perfect, but they raise the cost of an attack considerably. Understanding how they work helps you use them wisely and recognize when they are not doing their job.
How the Code Is Created Behind the Scenes
When you set up a code generator, the service creates a shared secret, usually a random string of letters and numbers, and shows it to you as a QR code or a text key. Your authenticator app stores that secret. Both your device and the service now hold the same secret, but nothing secret is sent during each login.
Each time a code is needed, the app takes the current time, rounds it to a thirty second block, and runs that value through a cryptographic function called HMAC, using the shared secret as the key.
The output is then shortened into a six digit number. Because the service runs the same calculation on its own clock, both sides arrive at the same number.
The method is described in an open standard, RFC 6238, which builds on RFC 4226 for the underlying one time password design. Because the standard is public and well reviewed, any compliant app can produce matching codes. The exact details, including the hash function most services use, can vary, so the service’s own help pages are the best reference.
Common Places You Will Meet These Codes
Time Based One Time Passwords show up in several everyday situations. Knowing where they appear helps you recognize a legitimate prompt and avoid confusing it with a scam. The following are typical examples:
- Email accounts that offer a two step sign in option in their security settings
- Online banking and investment sites that ask for a code after your password
- Work and school accounts that require a code from an app for remote access
- Cloud storage and developer platforms that let you add an authenticator app
- Password managers and other services that accept a generated code during setup
The screens look different from one service to another, but the principle is the same. You enter the six digit number from your app within its time window.
If a site asks you to send the code to someone, to read it aloud on a phone call, or to type it into an unfamiliar page, stop and verify the request through the official app or website first.
Where These Codes Are Weaker Than Other Options
A time based code protects you against a stolen password, but it does not stop every kind of attack. If a fake login page collects both your password and the current code and passes them to the real site immediately, the attacker can get in during the thirty second window.
This type of trick is called a real time phishing attack, and it is one reason some organizations now prefer stronger hardware based methods.
The shared secret is also a point of concern. If someone copies the secret from a QR code screenshot or from a compromised device, they can generate the same codes indefinitely until you reset the account. Treat any screenshot of a setup code as a sensitive item and delete it after you finish.
The codes depend on your device having the correct time. A phone that has drifted from the true time will produce codes the service rejects. These limits do not make the codes useless, but they mean you should combine them with other good habits rather than treat them as a complete shield.
Setting Up a Code Generator Step by Step
Begin in the security section of the account you want to protect. Look for an option labeled something like two step verification, multi factor authentication, or authenticator app. Choose the authenticator app method rather than text messages if the service offers both, because the app does not depend on your phone number being transferred to someone else.
Install an authenticator app from the official app store for your phone. Many password managers also include a built in generator, which can be convenient but means that anyone who opens your vault may see the codes.
Choose the option that matches how you already protect your devices. Then scan the QR code shown by the service, or type in the text key manually if scanning is not possible.
Before you leave the setup page, enter a code from the app to confirm it works. Save the backup codes the service provides in a secure place you control, such as a locked password vault or a printed copy kept at home. Do not skip this step, because backup codes are what let you recover if you lose the device.
Troubleshooting Codes That Will Not Work
Most failed code attempts come from a small set of causes. Working through them in order usually solves the problem without contacting support, and it helps you avoid being locked out later.
Checking the Clock on Your Phone
The most common reason a valid looking code is rejected is clock drift, meaning your device’s clock is off by more than the allowed window.
Because the code depends on the time, even a small mismatch can cause failures. Turn on automatic time setting in your phone’s date and time settings so that the device syncs with a network time source.
After adjusting the clock, close the authenticator app fully and reopen it. Wait for a fresh code to appear rather than typing one that was already on screen before the change. Fresh codes are the only ones that will match the service’s current time block.
If the problem continues, check that the app and the operating system are up to date. A simple restart of the phone can also clear time synchronization issues that persisted after a change.
Entering the Code in Time
Each code remains on screen for a short period, and the app usually shows a countdown ring or timer. If the code is close to expiring when you start typing, wait for the next one rather than racing the clock.
Entering a code that expires mid submission is a frequent source of errors that looks like a failure of the system.
Many services also limit the number of wrong attempts in a row and may temporarily block the account afterward. Repeated guessing can trigger these locks, so take a moment to confirm the code before submitting it again. Patience reduces the chance of a lockout that can be stressful to resolve.
If you have entered a code correctly several times and it still fails, the secret may have been removed or changed on the service side. In that case, use your backup method or contact the service through its official support channel to reset the second step.
Dealing With a Duplicate or Missing Entry
Sometimes an account appears twice in the authenticator app, or the entry you need has disappeared after an app update or device change. Duplicates are usually harmless, but using the wrong entry will produce codes that never work. Look carefully at the account name and the issuer shown beside each code before you type it.
If an entry is missing, do not start by deleting other entries. Instead, sign in with your backup codes or recovery method and reset the second step by scanning a new QR code. Keeping a record of which accounts use codes, stored safely, makes these situations far easier to manage.
Protecting the Shared Secret and Backup Options
The shared secret is the most valuable part of a code generator setup, because anyone who holds it can produce valid codes. Treat setup screens, QR code images and text keys as sensitive. Avoid posting them in forums, sending them to others, or keeping them in unprotected notes. When you finish setup, delete any screenshots that contained the secret.
Your phone is the device most likely to hold the secret, so protect it with a strong screen lock and keep its operating system updated. Enable the app’s own lock if it offers one, and consider whether your phone backups also include the authenticator data, since a backup you do not control could expose the secret.
Backup codes deserve the same care as your password. Store them somewhere separate from the phone that holds the app, so that losing the phone does not also remove your way back in. Consider keeping a second copy with a trusted family member or in a secure physical location you check regularly.
Choosing Between Apps and Hardware for Codes
Authenticator apps and hardware tokens both produce time based codes, but they differ in convenience, cost and how they are stored. An app on a phone is easy to use and free for most people.
A dedicated hardware token keeps the secret on a separate device, which can reduce the risk that malware on your phone reads it. Your choice depends on your daily habits and how sensitive the accounts are.
When evaluating an authenticator app, look for features that protect you rather than features that merely add convenience. Useful criteria include a passcode or biometric lock inside the app, clear support for backing up and restoring entries under your control, a transparent privacy policy, and a sound record of keeping up with security fixes. Avoid apps that request unnecessary permissions.
Hardware tokens are typically sold for use with a specific set of services, and they may not support every account you have. Check compatibility before you buy, and remember that a lost token must be replaced through the service’s recovery process, so keep a backup method in place either way.
Quick Checklist for Using These Codes Safely
Use the following habits as a practical routine whenever you set up or use a time based code on an account:
- Confirm the website address is the official one before entering any code or password
- Never share a code with anyone, including people claiming to be support staff
- Keep your phone clock set to automatic and your operating system updated
- Store backup codes in a location separate from the phone running the app
- Review which accounts use codes every few months and remove any you no longer use
Following these steps will not make you immune to every attack, but they close the most common gaps. Combine them with a unique password for each account and a password manager, and you will have a sturdy foundation. Revisit your setup after major phone changes, so that your recovery options still match the devices you use today.
Planning Your Next Steps With Code Generators
Start with the accounts that matter most: email, banking, cloud storage and any work account. Turn on time based codes for those first, then extend the practice to shopping sites and social media as your routine allows.
Writing a simple list of protected accounts and their recovery methods gives you a clear map to follow when you change phones or replace a device.
Look ahead as well. Some services now support stronger methods, such as security keys and passkeys, which resist real time phishing better than typed codes. Time based codes remain a valuable step while those options spread, and understanding their strengths and limits will help you judge new options when they appear.
Set a reminder to test your backup codes and confirm that you can still access your accounts. A brief check once or twice a year is far less stressful than discovering a problem during an urgent situation. Protecting your logins is an ongoing habit, and small, regular attention keeps it working.