TOTP
A widely adopted two-factor authentication standard defined by RFC 6238. It generates a six-digit verification code every 30 seconds by combining a shared secret key with the current timestamp and applying a hash algorithm, and is broadly used for account security verification.
Core Facts
Timeline (last 90 days)
One-time passwords (OTPs) are temporary codes generated by the time-based one-time password algorithm (TOTP), typically refreshed every 30 seconds, and used for two-factor authentication (2FA).
TOTP dynamic codes can technically be computed by the agent itself (the shared secret is programmable), but SMS and email verification codes must be read and forwarded by a human.
TOTP is defined in RFC 6238 and is a time-dimension extension of HOTP (RFC 4226); it is computed by dividing the current Unix timestamp by the time step to obtain a counter C, then computing HMAC-SHA1(K, C), extracting a 31-bit integer via dynamic truncation, and taking the result modulo 10^6 to obtain a 6-digit verification code.
In the TOTP algorithm the verification code changes every 30 seconds because the HMAC value stays the same within the same 30-second window, and once the boundary is crossed the counter increments by one and the HMAC result changes accordingly.
In a hands-on video by a Bilibili uploader, REA analyzed an APK app and located that the verification code generation logic uses the standard RFC 6238 TOTP algorithm, padding with zeros on the left when the result is fewer than 6 digits.
Hardware keys or app-based TOTP are more resistant to phishing and SIM hijacking than SMS verification codes.
Traditional MFA based on TOTP codes or push notifications can be bypassed when attackers set up reverse-proxy phishing pages to forward codes in real time or induce users to approve.
For education accounts, it is recommended to prioritize enabling MFA based on an authenticator app (such as TOTP) or a hardware security key rather than relying only on SMS verification codes, because SMS can be subject to SIM swap attacks.
The official troubleshooting checklist states: if the code expires during entry, wait for a new value and submit as soon as possible; if all codes fail, calibrate the computer clock; if the password is correct but the verification code is wrong, check the account and setup key; if no verification code is displayed, check the secret field and the Vault lock status.
RFC 6238 allows the server to tolerate a certain degree of drift, typically one 30-second window before and after, i.e. a tolerance range of about 90 seconds.
13 more timeline events
All Facts (20)
TOTP performs an HMAC-SHA1 hash of a static key combined with a 30-second time window of the current Unix timestamp, then truncates the result to a 6-digit dynamic verification code.
80%UnverifiedTOTP协议基于RFC 6238标准，每30秒生成一个6位动态码
95%UnverifiedOne-time passwords (OTPs) are temporary codes generated by the time-based one-time password algorithm (TOTP), typically refreshed every 30 seconds, and used for two-factor authentication (2FA).
50%UnverifiedTOTP dynamic codes can technically be computed by the agent itself (the shared secret is programmable), but SMS and email verification codes must be read and forwarded by a human.
50%UnverifiedTOTP is defined in RFC 6238 and is a time-dimension extension of HOTP (RFC 4226); it is computed by dividing the current Unix timestamp by the time step to obtain a counter C, then computing HMAC-SHA1(K, C), extracting a 31-bit integer via dynamic truncation, and taking the result modulo 10^6 to obtain a 6-digit verification code.
50%UnverifiedIn the TOTP algorithm the verification code changes every 30 seconds because the HMAC value stays the same within the same 30-second window, and once the boundary is crossed the counter increments by one and the HMAC result changes accordingly.
50%UnverifiedHardware keys or app-based TOTP are more resistant to phishing and SIM hijacking than SMS verification codes.
50%UnverifiedTraditional MFA based on TOTP codes or push notifications can be bypassed when attackers set up reverse-proxy phishing pages to forward codes in real time or induce users to approve.
50%UnverifiedFor education accounts, it is recommended to prioritize enabling MFA based on an authenticator app (such as TOTP) or a hardware security key rather than relying only on SMS verification codes, because SMS can be subject to SIM swap attacks.
50%UnverifiedRFC 6238 allows the server to tolerate a certain degree of drift, typically one 30-second window before and after, i.e. a tolerance range of about 90 seconds.
50%UnverifiedWhen passwords and TOTP secrets are stored in the same login entry, both are located in the same local Vault, and their degree of isolation is lower than placing the second factor on another physical device.
50%UnverifiedThe official troubleshooting checklist states: if the code expires during entry, wait for a new value and submit as soon as possible; if all codes fail, calibrate the computer clock; if the password is correct but the verification code is wrong, check the account and setup key; if no verification code is displayed, check the secret field and the Vault lock status.
50%UnverifiedSAFi v1.5.0 supports enterprise identity and access management capabilities, including Microsoft Entra ID single sign-on, TOTP multi-factor authentication, SCIM 2.0 user and role provisioning, automated account deprovisioning, DNS-based domain verification and tenant-aware workspace routing.
50%UnverifiedModern authentication systems (such as TOTP-based two-factor authentication, SMS verification codes, and FIDO2/WebAuthn hardware keys) are designed by nature to resist automated attacks, making it nearly impossible for AI agents to complete these verifications without possessing the user's physical device.
50%UnverifiedPassword managers such as 1Password and Bitwarden already support team-shared TOTP keys
50%UnverifiedAnyone who possesses a TOTP shared key can generate the exact same verification code, making shared 2FA technically straightforward
50%UnverifiedMFA requires users to provide an additional second verification factor when logging in, such as TOTP, a hardware security key, or biometrics.
50%UnverifiedBoth Vaultwarden and official Bitwarden support TOTP-based two-step verification and can be used with authenticator apps such as Aegis and Authy.
50%UnverifiedUnlike TOTP-based two-factor authentication, Passkeys use a challenge-response mechanism in which the service provider sends a random challenge value at each login, which the device signs with the private key and returns, eliminating the one-time password that could be intercepted and replayed by a man-in-the-middle.
50%UnverifiedBitwarden has a built-in authenticator feature that can generate one-time verification codes (2FA/TOTP).
50%