Discussion on "How Authenticator-App 2FA Codes Actually Work: Build a TOTP Generator in ~30 Lines (and Why It Beats SMS)"

Jaden Vo · 2026-10-31T01:01:01.023Z

TL;DR: An authenticator-app code is just HMAC-SHA1(secret, floor(unix_time / 30)), chopped down to 6 digits. The spec is RFC 4226 (HOTP) plus RFC 6238 (TOTP), and the whole algorithm fits in about 30

Discussion on "How Authenticator-App 2FA Codes Actually Work: Build a TOTP Generator in ~30 Lines (and Why It Beats SMS)" | Hashnode

Search Hashnode

How Authenticator-App 2FA Codes Actually Work: Build a TOTP Generator in ~30 Lines (and Why It Beats SMS)

Responses