Security Tools
8 min read
How TOTP 2FA Codes Work: RFC 6238 Math, Base32 Secrets, and Clock Drift
Understand how authenticator apps generate 6-digit 2FA codes. Learn the RFC 6238 time-step formula, HOTP dynamic truncation, Base32 secret encoding, otpauth:// URI parameters, and clock drift windows.