Time-Based One-Time Password (TOTP)

TOTP is a widely deployed second-factor mechanism in which the user's authenticator app (Google Authenticator, Authy, 1Password) and the server share a symmetric seed and compute the same HMAC-SHA1 hash over the current Unix time divided into 30-second windows. The visible 6-8 digit code changes automatically and is valid only briefly, which limits the value of shoulder-surfed or phished codes. TOTP works fully offline once the seed is provisioned, usually by scanning a QR code. Its main weaknesses are real-time phishing proxies (AiTM) that relay codes, malware on the device, and seed compromise on the server side; FIDO2 and passkeys are preferred where possible.