How Authenticator Apps Work: The Science Behind 6-Digit Codes

When you log into an online account and it asks for a 6-digit code from an authenticator app—like Google Authenticator, Microsoft Authenticator, or Authy—you’re using something called Time-based One-Time Passwords (TOTP). This method adds a second layer of security known as two-factor authentication (2FA).

Even though it looks simple, a lot of cryptographic engineering happens behind the scenes. Let’s break it down in a way that’s easy to follow.

1. The Secret Shared Key (Seed)

Before an authenticator app can generate codes for an account, the service (Google, Instagram, GitHub, etc.) and your authenticator app must share a secret.

This usually happens when you see a QR code during setup.

• The QR code contains:

  • A secret key (a long random string in Base32 format)
  • The account name
  • The type of OTP (usually TOTP)
  • The time interval (usually 30 seconds)

Your authenticator app scans the QR code and stores the secret locally on your device.

This shared secret is the foundation of all future code generation.

2. Time-Based Code Generation (TOTP)

Once your device has the secret key, it generates new 6-digit codes every 30 seconds using the TOTP algorithm—an industry standard defined in RFC 6238.

The core idea

The app generates a code by combining:

• The shared secret key
• The current time (rounded to 30-second intervals)

Because both your device and the server know the same secret and the same time, they can independently generate matching codes.

3. The Algorithm Behind the Code

Here is the step-by-step process of how a 6-digit code is produced:

Step 1: Calculate the time counter

The current Unix time (seconds since Jan 1, 1970) is divided by 30.

1time_counter = floor(current_unix_time / 30)

Example: If the time is 1697040000, then:

11697040000 / 30 = 56568000

This counter changes every 30 seconds.

Step 2: Combine the Secret Key and Time Counter Using HMAC-SHA1

HMAC = Hash-based Message Authentication Code SHA-1 = a hashing algorithm

The app computes:

1HMAC_SHA1(secret_key, time_counter)

This produces a long hash value.

Step 3: Dynamic Truncation

From the hash result, the algorithm extracts a 4-byte (31-bit) number.

This is done to ensure randomness and uniform distribution.

Step 4: Turn the Number Into 6 Digits

Take the 31-bit integer and compute:

1one_time_password = truncated_value mod 1,000,000

This gives a number between 000000 and 999999.

The app displays it, and it remains valid for 30 seconds.

4. How Services Verify Your Code

When you enter your 6-digit code:

1. The server repeats the same process:

   • Uses its copy of the shared secret
   • Computes time_counter
   • Runs HMAC-SHA1
   • Generates its own 6-digit code

2. If the server’s code matches yours, authentication succeeds.

Because clocks may drift, servers often check:

• The current 30-second window
• ±1 window (optional)

This ensures small timing differences don’t cause failures.

5. Why This Is Secure

✔ The secret key never leaves your device

Only the hashed output is used to generate codes.

✔ Codes expire automatically

A 6-digit code is only valid for ~30 seconds.

✔ Even if someone sees your code

They can’t generate the next one without the secret key.

✔ Resistant to brute-force

1,000,000 possibilities + rapid expiration = very hard to guess.

6. Common Authenticator Apps

Popular choices include:

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password / LastPass built-in authenticators

All of them use the same TOTP standard.

Summary

Authenticator apps work by using a shared secret key and the current time to generate a temporary 6-digit code using the TOTP algorithm. The steps are simple but mathematically strong:

1. Share a secret key during setup
2. Compute a time counter (every 30s)
3. Apply HMAC-SHA1 to secret + time
4. Truncate and format to 6 digits
5. Server and app generate the same code independently
6. If codes match → login successful

It’s one of the most effective, secure, and widely used forms of two-factor authentication today.