Authenticator Apps Explained: TOTP, HOTP, and Setup Guides

The Problem Authenticator Apps Solve

Every time you log into an important account, you want proof that the person entering the password is actually you. A password alone cannot provide that proof — passwords get stolen, guessed, and leaked in breaches every day.

Authenticator apps solve this by generating temporary, one-time codes that expire every 30 seconds. These codes are produced entirely on your device using a shared secret that only you and the service know. Even if someone sees your code, it is useless 30 seconds later.

Unlike SMS-based codes, authenticator app codes are generated offline, cannot be intercepted through SIM-swapping, and do not require cellular service. This makes them one of the most reliable and secure multi-factor authentication methods available.

In this guide, we will break down exactly how authenticator apps work under the hood, explain the difference between TOTP and HOTP, walk through setup step by step, and cover how to migrate between apps without losing access to your accounts.

---

How TOTP Works: The Science Behind the Code

TOTP stands for Time-based One-Time Password. It is defined in RFC 6238 and is the algorithm used by virtually every authenticator app on the market.

The TOTP Formula

The TOTP algorithm works like this:

TOTP = HOTP(SecretKey, Floor(CurrentTime / 30))

Here is what each part means:

1. SecretKey: A random string generated when you set up 2FA. This is the “seed” — both your app and the server share this secret.
2. CurrentTime: The current Unix timestamp (seconds since January 1, 1970).
3. Floor(CurrentTime / 30): The current time divided by 30, rounded down. This creates a 30-second window.
4. HOTP(): A hashing function (HMAC-SHA1) that combines the key and counter to produce a code.

The result is a 6-digit number that both your app and the server can compute independently — no internet connection required. Because both sides share the same secret and the same clock, they arrive at the same code.

Why 30 Seconds?

The 30-second window is a deliberate design choice. It is long enough to account for minor clock drift between devices, but short enough that a stolen code has a very limited window of usefulness. Each new 30-second window produces a completely different code.

The Seed Secret

When you scan a QR code during authenticator app setup, you are downloading a seed secret. This secret is typically a base32-encoded string like:

JBSWY3DPEHPK3PXP

This seed is the foundation of your TOTP codes. Anyone who possesses this seed can generate the same codes as your app — which is why keeping it secret is critical.

---

TOTP vs. HOTP: What Is the Difference?

TOTP is actually a specific implementation of a broader algorithm called HOTP.

Feature	HOTP (HMAC-based)	TOTP (Time-based)
Full Name	HMAC-based One-Time Password	Time-based One-Time Password
RFC Standard	RFC 4226	RFC 6238
Code Trigger	Counter increments with each use	Time increments every 30 seconds
Code Expiration	Does not expire until used	Expires after 30 seconds
Synchronization	Requires counter sync between app and server	Requires clock sync (tolerates minor drift)
Primary Use	Hardware tokens, offline systems	Authenticator apps, most 2FA setups
Common Apps	YubiKey (in some modes)	Google Authenticator, Aegis, Authy

For most users, TOTP is what matters. It is the default for virtually every website and service that supports authenticator app-based 2FA. HOTP is used primarily in hardware token scenarios and specialized enterprise deployments.

---

Step-by-Step: Setting Up an Authenticator App

Follow this guide to set up an authenticator app for any service that supports TOTP-based 2FA.

Setup Steps

Step	Action	Details
1	Choose an authenticator app	Popular options include Aegis (Android, open-source), Google Authenticator (Android/iOS), and Bitwarden Authenticator (cross-platform). We recommend Aegis for its encrypted backups and open-source code.
2	Navigate to security settings	Go to the account you want to protect. Find “Security,” “Two-Factor Authentication,” or “Multi-Factor Authentication” in your account settings.
3	Select authenticator app	Choose the option that says “Authenticator App,” “TOTP,” or “Time-based One-Time Password.”
4	Scan the QR code	Open your authenticator app and scan the QR code displayed on screen. The app will prompt you to add the account.
5	Enter the verification code	Your app will immediately start generating 6-digit codes. Enter the current code into the verification field on the website to confirm setup.
6	Save backup codes	The service will provide one-time-use backup codes. Copy and store these securely — write them on paper and keep them in a safe place.
7	Test the setup	Log out and log back in. Enter your password, then open your authenticator app and enter the current code. Confirm everything works before closing the setup page.

What the QR Code Contains

Behind the scenes, the QR code encodes a URI like:

otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30

This URI contains:

• Type: TOTP (or HOTP)
• Account name: Your username or email
• Secret: The base32-encoded seed
• Issuer: The service name
• Algorithm: SHA1 (most common), SHA256, or SHA512
• Digits: Usually 6
• Period: Usually 30 seconds

---

Recommended Authenticator Apps

Not all authenticator apps are created equal. Here are the top options:

Aegis Authenticator (Android)

• Open source — fully auditable code
• Encrypted backups to Google Drive or local storage
• Supports multiple vaults and categories
• Biometric unlock
• Best for: Android users who want maximum security and control

Google Authenticator (Android/iOS)

• Simple, widely recognized interface
• Recently added Google account sync
• Limited features compared to alternatives
• Best for: Users who want simplicity above all else

Bitwarden Authenticator (Android/iOS/Desktop)

• Integrates with Bitwarden password manager
• Cross-platform support
• TOTP codes stored alongside passwords
• Best for: Bitwarden users who want everything in one ecosystem

Raivo OTP (iOS)

• iCloud sync
• Encrypted backups
• Clean interface
• Best for: iOS users looking for a lightweight option

---

Migrating Between Authenticator Apps

Switching phones or switching authenticator apps does not have to mean losing access to your accounts. Here are your options:

Method 1: Export from Old App

Most authenticator apps support exporting your TOTP seeds:

1. Open your old authenticator app.
2. Find the export or backup option (usually in settings).
3. Export as an encrypted file or QR codes.
4. Import into your new app.

Note: Google Authenticator recently added account sync, which simplifies migration for its users. Aegis supports encrypted backup files that can be restored on any Android device.

Method 2: Re-Scan QR Codes

If you saved the original QR codes (or text-based seed secrets) during initial setup, you can scan them into your new app. This is why we recommend saving seed secrets in a secure offline location during setup.

Method 3: Re-register with Each Service

If you cannot export from your old app, you will need to:

1. Log into each service.
2. Disable 2FA in the security settings.
3. Re-enable 2FA and scan the new QR code with your new app.
4. Save new backup codes.

This is the most time-consuming method but is always available as a fallback.

Migration Checklist

Step	Action	Priority
1	Export TOTP seeds from old app	High
2	Import seeds into new app	High
3	Verify codes work for 2-3 critical accounts	High
4	Generate new backup codes for critical accounts	Medium
5	Re-register services that could not be migrated	Low
6	Delete old app after confirming migration	Low

---

Seed Secret Security: What You Must Know

The TOTP seed secret is the single most sensitive piece of data in your authenticator setup. If someone obtains your seed, they can generate your codes indefinitely.

Rules for Seed Secret Security

1. Never share your seed. Do not email it, text it, or store it in unencrypted form.
2. Never screenshot the QR code. Screenshots can be synced to cloud storage or accessed by malware.
3. Save the text-based seed securely. Write the base32 seed on paper and store it in a fireproof safe or secure lockbox.
4. Consider encrypted digital backups. Aegis supports encrypted vault backups. Store the backup file in a secure location.
5. Treat seeds like passwords. A compromised seed is just as dangerous as a compromised password.

You can generate strong, random backup codes to pair with your seed secrets using our Password Generator.

---

Common Authenticator App Issues and Fixes

Issue 1: Code Not Working

If your authenticator app code is rejected:

• Check your device clock. TOTP relies on accurate time. Go to your device settings and enable “Automatic date & time” or “Use network-provided time.”
• Try the previous or next code. Some services accept codes from adjacent time windows to account for clock drift.
• Re-sync the app. Some apps have a “sync” or “time correction” option in settings.

Issue 2: Lost Phone, No Backup

If you lose your phone and have no backup codes:

• Check if your authenticator app had cloud sync enabled (Google Authenticator sync, Aegis encrypted backup, iCloud for Raivo).
• If no backup exists, contact each service’s support team for account recovery.
• This is preventable: always save backup codes and seed secrets during initial setup.

Issue 3: Time Drift Between Devices

If your codes do not match the server’s expected code:

• Enable automatic time synchronization on your device.
• On Android: Settings > Date & Time > Use network-provided time.
• On iOS: Settings > General > Date & Time > Set Automatically.

Issue 4: Too Many Accounts to Manage

If you have dozens of TOTP codes:

• Use an app that supports categories or vaults (Aegis, Bitwarden).
• Consider a password manager with built-in TOTP support (Bitwarden, 1Password).
• Prioritize: enable TOTP on your most critical accounts first, then expand.

---

Authenticator Apps and Strong Passwords

Authenticator apps protect your accounts by adding a second factor, but the first factor — your password — still matters. A weak password combined with TOTP is less secure than a strong password with TOTP.

Use our Password Generator to create unique, high-entropy passwords for every account. Then verify their strength with our Password Strength Checker. For a deeper dive into password creation, read our guide on how to create strong passwords.

---

Frequently Asked Questions

Are authenticator apps better than SMS codes?

Yes. Authenticator app codes are generated offline on your device and are not vulnerable to SIM-swapping attacks, which are the primary weakness of SMS-based MFA. The FBI has documented thousands of SIM-swapping incidents, making authenticator apps the safer choice for most users.

Can I use the same authenticator app for all my accounts?

Yes. Authenticator apps can store TOTP seeds for as many accounts as you need. Each account gets its own unique seed and generates independent codes. There is no limit to the number of accounts you can add.

What happens if my device clock is wrong?

TOTP codes depend on accurate time. If your device clock is more than 30 seconds off from the server's clock, your codes will not match. Enable automatic time synchronization in your device settings to prevent this issue.

Is it safe to store TOTP seeds in my password manager?

It depends on your threat model. Storing TOTP seeds in a password manager means a single compromise could expose both your passwords and your 2FA codes. For maximum security, keep TOTP seeds in a separate app or offline storage. For convenience, many users store them in their password manager. At minimum, always use a strong master password and enable MFA on your password manager.

How do I switch from Google Authenticator to Aegis?

In Google Authenticator, go to Settings > Export accounts. Export your accounts as QR codes. Then open Aegis and use the "Import from image" or "Scan QR code" option to import each account. Verify the codes match before deleting the old app. If you need backup codes, generate them with our [Password Generator](/password-generator).

---

About the Author

The GeneratePass Editorial Team builds privacy-first security tools that run entirely in your browser. Every tool on GeneratePass processes data locally — nothing is ever sent to a server. Visit generatepass.me to try our free Password Generator, Password Strength Checker, and Breach Checker.