When you open an authenticator app like Google Authenticator, Authy, or your integrated password manager, you are presented with a 6-digit code that rapidly changes every 30 seconds. One of the most counterintuitive aspects of these applications is that they continue to generate perfectly accurate security codes even if your smartphone is entirely disconnected from the internet or cellular networks. This offline capability is governed by the Time-Based One-Time Password (TOTP) algorithm.

The Cryptographic Seed and the Unix Epoch

The magic of TOTP relies on two specific components that both the server and your device must share: a secret cryptographic key (known as the seed) and a synchronized clock. When you initially scan a QR code to set up 2FA, that QR code contains the secret seed string. Your phone saves this string locally.

To generate the 6-digit code, the app runs a cryptographic hash function (HMAC-SHA1) that mathematically combines the secret seed with the current time—specifically, the number of 30-second intervals that have passed since the Unix Epoch (January 1, 1970). Because the website's server also knows the exact same secret seed and the exact same current global time, it runs the identical math equation. If the server's generated 6-digit code matches the one you type in, access is granted. No network connection between your phone and the server is ever required during the login moment.