On this page
Six digits appear in your authenticator app and the website accepts them, though nothing travelled from the website to your phone. How did both sides agree? Two short internet standards and some school maths: division, remainders and binary.
What is an OTP, and who makes it?
A one-time password (OTP) is a short code that works once and then expires. An SMS code is made by the service and texted to you. An authenticator-app code is computed on your phone.
The base rule is HOTP, published in December 2005 as RFC 4226. It defines the code as HOTP(K, C) = Truncate(HMAC-SHA-1(K, C)), where K is a secret key and C is a counter. The time-based version, TOTP, followed in May 2011 as RFC 6238, and replaces the counter with a count of time steps.
How are OTPs generated, step by step?
The recipe, in order:
Share a secret once. At setup, usually by scanning a QR code, your app and the server store the same secret key K. RFC 4226 says this secret must be at least 128 bits long and recommends 160 bits.
Count time steps. Your phone works out T = floor((current Unix time − T0) / X). RFC 6238 sets the defaults: X is 30 seconds and T0 is the Unix epoch, 1 January 1970.
Hash. It computes HMAC-SHA-1 of T using the key K (RFC 6238 also allows SHA-256 or SHA-512). The SHA-1 output is 160 bits, which is 20 bytes.
Pick four bytes. It reads the last 4 bits of byte 19 as a number from 0 to 15. That number, the offset, says where to start reading four bytes. It drops the top bit, leaving a 31-bit number.
Keep the last digits. It takes that number mod 10^6 (the remainder after dividing by 1,000,000) to get six digits. RFC 4226 says codes must have at least 6 digits.
The server does the same. If the two results match, you are in.
Worked example: from 20 bytes to six digits
RFC 4226 prints an example HMAC-SHA-1 result so you can check the steps by hand. Its 20 bytes, in hexadecimal, are 1f 86 98 69 0e 02 ca 16 61 85 50 ef 7f 19 da 8e 94 5b 55 5a.
The last byte, byte 19, is 5a. Its last 4 bits are hex a, which is 10, so the offset is 10.
The four bytes starting at byte 10 are 50 ef 7f 19, giving the number 0x50ef7f19.
Its first byte, 0x50, is below 0x80, so dropping the top bit changes nothing.
0x50ef7f19 is 1,357,872,921, and mod 1,000,000 that leaves 872921. That is the code.
Now the time step. RFC 6238 uses the Unix time 1111111109 (18 March 2005) as a test case. Divide by 30 and you get 37037036.97, so T = 37037036, written 23523EC in hex in the RFC's table. With the RFC's test key, the 8-digit code for that moment is 07081804, so the 6-digit code is its last six digits, 081804.
The RFC's simplest case: at Unix time 59 seconds, T = 1; at 60 seconds, T = 2 and the code changes. If remainders or hexadecimal feel shaky, the Fermi Concept Library has a lesson for every concept in mathematics and computing.
Why does the code change every 30 seconds?
Thirty seconds is a trade-off. RFC 6238 says the 30-second default was chosen as a balance between security and usability. A longer step gives an attacker who sees your code more time to use it. A shorter one leaves you racing the clock.
Messages take time to arrive, so the RFC recommends allowing at most one time step for network delay, plus a set limit on clock drift. It also says a server must not accept the same code twice. That rule is what makes the code "one-time".
What does this mean for keeping your OTP safe?
The maths holds up. RFC 6238 notes that the analysis in RFC 4226 found the best possible attack on HOTP is brute force, which means guessing. The weak point is people. Whoever has your current code can use it within its window if they get in before you, and whoever has the secret key can make every future code.
Never read an OTP out to a caller, however official they sound.
Treat the setup QR code like a password: do not screenshot or share it.
Keep backup codes somewhere safe. Our guide to a password manager for students shows one way to do it.
If you are setting rules for a teenager's payments, see UPI rules for teenagers.
If a code has already been shared and money or an account is at risk, follow the steps to report cybercrime online in India straight away.
Next time a code rolls over in your app, work out its time step from the clock.
