Learn
What is 2FA? And how do those 30-second codes actually work?
A complete, plain-English guide: what two-factor authentication is, the cryptography behind six-digit TOTP codes, which factor to enable on which account, and how to never get locked out.
Why passwords alone fail
Every login needs a password, and passwords have three structural problems: they get reused, they get guessed by credential-stuffing attacks over reused databases, and they get phished out of people. Two-factor authentication (2FA) accepts a simple truth — humans are the weakest link — and adds a second, independent thing an attacker must also possess. With 2FA, a leaked password by itself is no longer enough to get into your account.
Most major services now either offer or require 2FA: GitHub has enforced it since 2023, crypto exchanges (Binance, Coinbase, Kraken) push it at every downturn, and Microsoft, Google and Apple have rolled it into account security as the default.
The three factors
Authentication factors fall into three categories:
- Something you know — passwords, PINs. Cheap to deploy and easy to phish.
- Something you have — an authenticator producing codes, a hardware security key or passkey, a phone receiving SMS. This is where 2FA lives.
- Something you are — fingerprints, face recognition. Convenient, but enrolled on-device rather than the primary remote factor.
A true two-factor check combines technique from two different categories. A password plus pattern unlock on your phone is not 2FA; a password plus a rotating authenticator code is.
How TOTP works, step by step
- Enrollment. When you switch a service on, it generates a random secret and shares it with you once — drawn as a QR code or shown as a Base32 setup key. In security terms this single moment carries all the risk, which is why you should only ever reveal the key where you trust it.
- Time ticks. The current time is divided into 30-second "steps":
step = floor(unixTime / 30). There is nothing special about 30 — the standard merely recommends it; each service picks its own time-step, and it has to be agreed on both sides. - HMAC. Your authenticator computes an HMAC hash (SHA-1 for most services, sometimes SHA-256/512) over the step value, keyed by the secret. HMAC is a one-way construction: seeing the result tells you nothing about the secret.
- Digit extraction. Four bytes of the HMAC output are selected by the last nibble, the top bit is cleared, and the result modulo 10n becomes your code — usually
n= 6, occasionally 7 or 8. - Verification window. The server recomputes the same value for the current and previous step (to tolerate small clock drift). Matching proof and login get accepted.
Everything above runs in microseconds, entirely on-device. That's why a client-side tool like 2FA COUNTER can do the entire job locally — load the page, disconnect from the internet, and codes still stream out every 30 seconds, forever.
The secret and the QR code
The Base32 string is not some intermediate format — it's the raw bytes of the secret encoded in a phone-friendly alphabet (A–Z plus 2–7, deliberately excluding 0/1 which are easily confused, and safe on any keyboard). When a platform offers "can't scan?", the resulting string contains thesame private material the QR encodes. You can store either form; the semantics are identical:
otpauth://totp/GitHub:you%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=GitHub
otpauth://totp/Binance:me?secret=JBSWY3DPEHPK3PXP&digits=6&period=30&algorithm=SHA1
otpauth://hotp/Example:you%40example.com?secret=...&counter=5 ← counter-based (HOTP) variant (rare)A modern generator honors every parameter: digit count, period, hash algorithm and HOTP counter — because a service that specifies SHA-256 will still reject a default SHA-1 code. A bare Base32 key defaults to 6 digits, 30 s, SHA-1, which is what the bulk of services use.
TOTP vs. SMS vs. hardware keys
- SMS codes travel across the telecom network. SIM-swap attacks let an adversary hijack your phone number and receive every code — and delivery can simply fail. NIST's US standards formally restrict phone-delivered codes (SP 800-63B classifies SMS out-of-band authentication as "RESTRICTED"), and the EU's PSD2 rules push services toward authenticator-app factors.
- TOTP never transmits anything — the code is computed locally and expires in 30 seconds. Free, standards-based, and supported everywhere. Weaker link: it can be phished within its validity window.
- Security keys and passkeys (WebAuthn/FIDO2) are cryptographically bound to the exact domain, so fake lookalike pages fail automatically. Strongest option; less widely supported and costs a key.
The practical ladder: use SMS only if you must, TOTP by default, hardware keys or passkeys for the accounts that matter most.
Deep dives into the trade-offs: TOTP vs. passkeys — which factor belongs where, how SIM-swap attacks defeat SMS codes, and what app cloud-sync does to your secret keys.
What 2FA doesn't fix
Two-factor solves password theft. It does not stop session-cookie theft (malware already running on your machine), browser extensions with overbroad permissions, a recovery email you lost control of, or social engineering where an attacker pressures you into reading out a fresh code within its 30-second window. Keep your browsers updated, prune extensions ruthlessly, and treat any panic request for a code as the red flag it is.
How to never get locked out
- Save the backup codes. Every service prints a one-time bundle of recovery codes when you enable 2FA. Print or store them encrypted and offline.
- Keep the secret, not just the tool. The Base32 key written to your password-manager vault lets you re-generate codes with any authenticator — a phone app, or the browser-based generator — on whatever device you actually have that day.
- Enroll two devices, not one. A key can safely live on two trusted devices at once. TOTP is deterministic: same secret, same codes.
- Watch your clock. If codes regularly fail, fix device time-sync first — it's the single most common cause of "invalid code" errors, and no tool can work around it.
FAQ
What is 2FA?
2FA (two-factor authentication) means proving who you are with two different kinds of evidence: something you know (your password) plus something you have (a code that changes every 30 seconds, a security key, or your phone). A password alone can leak or be guessed; the second factor makes a leaked password useless on its own.
Why is 2FA so important?
Because passwords keep failing. Billions of real passwords are already public from data breaches, and attackers log into other people's accounts with them (credential stuffing) around the clock. Microsoft reports that 2FA blocks over 99.9% of automated account-takeover attacks — it protects your email, banking, social media, gaming, and crypto accounts from exactly the threats that actually happen.
What is 2FA used for?
It protects any login worth stealing: email and cloud accounts (Google, Microsoft, Apple), banking and finance, crypto exchanges (Binance, Coinbase, Kraken), developer platforms (GitHub, AWS), gaming (Steam, Discord, Twitch), and social media (X, Instagram). Workplaces also use it for VPNs, email, and admin consoles. Wherever a service offers an "authenticator app" option, 2FA is the right tool.
How does 2FA work?
After you enter your password, the service asks for a second proof. With the most common method (TOTP), your authenticator derives a fresh 6-digit code from a shared secret plus the current time (the RFC 6238 standard) while the server runs the identical calculation and compares results. The code rotates every 30 seconds and can never be reused, so an attacker with only your password still can't get in.
How does a TOTP code get generated?
The website gives you a secret key (usually as a QR code or a Base32 string). Your authenticator computes HMAC (with SHA-1, SHA-256 or SHA-512) over the current 30-second time window using that secret, then reads 6 digits from the result. The website runs the identical calculation and compares. No network is needed because both sides already share the secret.
How to get 2FA?
You get 2FA from the account you want to protect: open its settings, find "Security" or "Login & security", and look for "Two-factor authentication" or "2-step verification". Choose the authenticator-app option, scan the QR code (or reveal the setup key), and enter the code shown in your authenticator to confirm. Our step-by-step walkthrough covers getting a code without a phone: /how-to-get-2fa-code/.
How to enable 2FA?
Four steps: 1) Open the service's account or security settings and select "Two-factor authentication". 2) Pick "Use an authenticator app" (avoid SMS if you can). 3) Scan the QR code with your authenticator — or click "can't scan?" and save the setup key. 4) Enter the live code to finish, then download or print the backup/recovery codes it shows. We publish per-service setup guides for Google, GitHub, Discord, Binance and more at /guides/.
How strong is 2FA?
It depends on which second factor you use. SMS codes are the weakest —SIM-swap attacks can hijack a phone number and intercept them. TOTP authenticator codes (the 30-second kind) are computationally strong: an offline attacker cannot derive them, and live codes expire in seconds. Hardware security keys and passkeys are the strongest, because they are phishing-resistant and cryptographically bound to the real website.
Is 2FA 100% safe?
No security measure is 100% safe, and honest 2FA guides say so. 2FA defeats stolen passwords, but the code itself can still be phished if you type a live code into a fake site within its 30-second window; malware already running on your device can steal sessions; and if SMS is your second factor, SIM swaps are a real threat. That said, enabling 2FA makes you dramatically harder to attack than password-only accounts.
Is 2FA compulsory?
Not by law, but more and more services make it mandatory: GitHub has required it for code contributors since 2023, many banks and crypto exchanges force it on, and employers commonly require it for work logins. Everywhere else it is optional but strongly recommended. In practice, treat 2FA as compulsory for your most valuable accounts: email first, because a hijacked inbox can reset everything else.
Why does everything use 2FA now?
Because the password-only era failed. Mass breaches exposed billions of credentials, credential-stuffing attacks got automated and cheap, and platforms now carry the cost of hijacked accounts. Regulators pushed too: NIST's US standards formally restrict SMS-based authentication (SP 800-63B classifies SMS out-of-band codes as "RESTRICTED"), and the EU's PSD2 rules require strong customer authentication. Once a few giants made 2FA normal, every other service followed.
What is the difference between TOTP, HOTP, and OTP?
OTP just means "one-time password". TOTP (Time-based OTP, RFC 6238) derives the code from the current time, so it changes every 30 seconds. HOTP (RFC 4226) is counter-based: each code is used once and the counter increments. Nearly every "authenticator app" service — Google, Microsoft, Discord, GitHub — uses TOTP.
Why is TOTP better than SMS 2FA?
SMS codes travel over the phone network, where they can be intercepted or stolen by SIM-swap attacks — and SMS delivery can simply fail. TOTP codes are computed on your device, never transmitted, and expire within seconds. NIST's US standards formally restrict SMS as an authentication factor for federal services.
Can TOTP codes be stolen by a phishing site?
Yes — if you type a fresh code into a phishing page within its 30-second validity window, the attacker gets one working login. That is why phishing-resistant factors (hardware security keys and passkeys, which cryptographically bind to the real domain) are the strongest option where offered. TOTP beats SMS and passwords, not hardware keys.
Where should I keep my 2FA secret key?
In an encrypted password-manager vault, as your master copy. That way you can re-generate codes on any trusted device — including in a browser with a tool like 2facounter.com — if your phone is unavailable. Also save the backup/recovery codes every service prints when you enable 2FA; those are your true airbag.