What Is TOTP? Two-Factor Codes Explained
By Harshil Kachhadiya · Updated · 4 min read
If you have ever typed a six-digit code from an authenticator app, you have used TOTP. This guide explains what happens behind that code and how to manage it safely.
How TOTP works
TOTP stands for time-based one-time password and is defined in RFC 6238. When you enable it on a website, the site gives you a shared secret, usually shown as a QR code and a base32 text key. Your authenticator stores that secret.
Every 30 seconds, the authenticator combines the secret with the current time using HMAC and shows the last six digits. The website performs the same calculation and compares. No network connection is needed on your device, and each code is useless once its time window passes.
Why it beats SMS codes
Codes sent by text message can be intercepted through SIM-swapping or redirected phone numbers. A TOTP secret lives on your device and never travels in a message. It is not immune to phishing, since a fake site can ask for a live code, but it removes a whole class of attacks.
Where to keep the setup key
The shared secret is as sensitive as a password: anyone who has it can generate valid codes. If you lose your phone and did not save the key, you can be locked out. Storing the key in your encrypted vault gives you a backup and the convenience of codes alongside the login.
In Padlock, you save a site's base32 TOTP secret with the entry. Padlock generates the live six-digit code with a countdown, and the secret is encrypted in your browser like every other password, so the server only stores ciphertext.
Set it up in four steps
- Open the security settings of the account and choose authenticator-app two-factor authentication.
- Choose the option to enter the setup key manually, and copy the base32 key.
- Paste the key into the entry for that site in your vault.
- Enter the code your vault shows to confirm, and save the site's backup codes as a secure note.