TOTP is a code tied to a secret and a moment in time

A shared setup key is the starting point

When an account enables TOTP, the website and the authenticator obtain matching secret material. The setup QR or Base32 string conveys that material. For each time step, both sides use an agreed algorithm to calculate a short numeric value. The authenticator does not need to ask the website for every new code, which is why time-based codes can continue appearing when a device is temporarily offline.

Anybody who obtains the setup secret and learns the configuration can independently generate future values. This is why the QR shown during enrollment and a Google Authenticator export QR should be handled as long-lived credentials. A screenshot of the QR can be far more dangerous than a screenshot of a single expiring numeric code.

What the timer means

TOTP uses a time counter derived from an epoch, the current clock, and a period. A common configuration changes every 30 seconds, but the TOTP family also supports other periods when both authenticator and verifier agree. The display countdown tells you when your local generator will move to the next counter value. A site may accept a narrow neighboring window to tolerate clocks that are not perfectly aligned; the site's acceptance rules remain outside 2FASync's control.

The code is not usually an independent password that becomes invalid simply because you have already looked at it. It is a time-window value. An attacker who captures it can sometimes act before expiration. TOTP therefore improves the security of many password logins but is not considered phishing resistant against real-time relays.

The algorithm and digits must match

A TOTP profile includes an HMAC algorithm, code length, period, and secret. 2FASync supports SHA-1, SHA-256, and SHA-512 in six- or eight-digit profiles, with strict input validation. A bare Base32 key is interpreted using the common six-digit, SHA-1, 30-second settings; an encoded otpauth TOTP URI can carry its own supported values. The website may support only one combination, so preserve its actual enrollment instructions.

HOTP looks similar on the screen, but its moving factor is a counter that advances with events, not a shared time window. An HOTP seed cannot safely be treated as a TOTP seed without changing the mechanism. That distinction matters when a QR import reports an unsupported type.

Why TOTP sometimes stops working

The usual first checks are that your device's clock is accurate, the code has not crossed into a new window, the right account entry is selected, and the original website actually expects TOTP. A mismatched SHA algorithm, number of digits, period, or Base32 character can produce consistent but unusable numbers. Repeated attempts may trigger rate limits on the destination account, so avoid guessing aggressively.

For migration, compare the old authenticator and the imported result before removing the old enrollment. Use original-service recovery options if the underlying seed has been lost. See the troubleshooting guide for a diagnostic order that avoids exposing the seed to support staff or external QR scanners.

Why can TOTP work without internet access?

Once a device has the secret, the agreed algorithm, and a reasonably accurate clock, it can calculate the code locally. The destination website still needs to verify it when you sign in.

Is the six-digit number my TOTP secret?

No. The setup key is a long-lived secret; the six- or eight-digit code is derived for a limited time window.