How TOTP Authenticator Apps Generate Secure One-Time Codes Without Internet

Time-based One-Time Passwords (TOTP) are temporary codes used as a second layer of identity verification during login, requiring no cellular or internet connection to function. During setup, a server generates a unique secret key, transfers it to the user's authenticator app via QR code scan, and that key is stored locally — no further network communication is needed. Both the app and the server independently calculate the same 6-digit code by combining the shared secret key with the current 30-second time block using a cryptographic HMAC function. The resulting hash is trimmed down through a series of mathematical steps to produce a short, human-readable passcode that expires every 30 seconds. To handle minor clock discrepancies between devices, servers typically accept codes from the current window as well as the windows immediately before and after, providing a roughly 90-second tolerance margin.