How TOTP works: the math behind your six-digit codes
Every 30 seconds your authenticator produces a fresh code a server accepts — without the two ever talking. We unpack the shared secret, HMAC, dynamic truncation, and the 30-second window, from first principles.
Read the deep-dive →






