What Is QR TOTP? How Authenticator Codes Work
Learn what a TOTP QR code contains, why authenticator codes usually change every 30 seconds, and how they work offline without sending a message.
The Trick Behind the 6 Digits
When you scan a 2FA QR code, the service hands your authenticator a secret key — a long random value that only you and the service know. From then on, both sides independently compute the same function: secret key + current 30-second window → 6-digit code. When you type the code, the server runs the same calculation and checks for a match. No message is ever sent to your phone; you both just know the answer.
That's TOTP — Time-based One-Time Password, an open standard (RFC 6238) used by Google, Microsoft, banks, and effectively every service that offers app-based 2FA.
The QR Code and the TOTP Code Are Different
The QR code is used during enrollment and normally contains an otpauth:// setup URI: the secret key, account label, issuer, algorithm, digit count, and time period. Your authenticator saves those settings once. The changing six-digit number shown afterward is the TOTP code calculated from that stored secret and the current time.
Because the enrollment QR contains the permanent secret, a screenshot of it can reproduce every future code. Treat that image like a password, verify the account after importing it, and remove temporary copies when they are no longer part of your recovery plan.
Why This Design Is Quietly Brilliant
- Works offline: the code is computed, not received — airplane mode, dead zones, and foreign SIMs don't matter.
- Codes expire in 30 seconds: a stolen code is nearly worthless moments later.
- Nothing to intercept: unlike SMS codes, there's no message in transit to hijack.
- One app, every service: because it's an open standard, a single authenticator holds codes for all your accounts.
What This Means for How You Use It
Understanding TOTP explains the practical rules. The QR code contains the permanent secret — treat screenshots of it like passwords (or use them deliberately, as our screenshot import guide shows). Phone clock accuracy matters, since time is half the formula — keep automatic time setting on. And the secret living only on your device is why phone upgrades need a plan: sync or migrate before you wipe.
TOTP in Authenticator App 2FA
Authenticator App 2FA is a full TOTP implementation: scan any standard 2FA QR code, import one from a screenshot, or paste a setup key manually, and the app generates codes completely offline. Secrets stay in a Keychain-backed vault behind Face ID, with optional iCloud sync across your Apple devices — the open standard's portability with iPhone-native protection on top.
Keep Your Codes Private and Ready
Download Authenticator App 2FA and manage offline OTP codes with QR scan, screenshot import, Face ID lock, and iCloud sync.
