TOTP

TOTP, or Time-based One-Time Password, is the standard behind the six-digit codes that authenticator apps generate for two-factor authentication. When you enable it, the service and your app share a secret key; both then combine that secret with the current time to compute a short code that changes every 30 seconds, so a code intercepted or reused later is worthless.

For example, when securing an exchange account you scan a QR code with an app such as Google Authenticator or Authy. The QR code contains the shared secret. From then on, logins and withdrawals require the current six-digit code from your app, and the exchange verifies it by running the same computation on its side. The scheme works entirely offline on your phone; no network or SMS is involved.

TOTP is considerably safer than SMS codes because it cannot be stolen through a SIM swap. Its main weaknesses are phishing sites that relay your code in real time, and loss of the device holding the secrets, which is why services provide backup codes to store safely at setup. A common misconception is that the codes come from the service; they are computed locally from the shared secret and the clock, which is also why a badly wrong phone clock makes codes fail.