·12 min read
Your authenticator works in airplane mode: how TOTP really works
The 6-digit code is never transmitted — it is derived. A full walk through RFC 6238: the shared secret exchanged once at enrolment, the time step, HMAC-SHA1 and dynamic truncation, the verification window and clock drift, replay prevention and rate limiting, plus the attacks TOTP does and does not stop.
Intermediate- Security
- Authentication
- Cryptography
- MFA
