What is TOTP?
The Six Digits That Change Every Thirty Seconds
TOTP - Time-based One-Time Password - generates a fresh code by combining a secret shared at setup with the current time, sliced into thirty-second windows. Your device and the service compute the same answer independently, with no network involved. It is the open standard behind virtually every authenticator app.
How It Works
Three ingredients produce a TOTP code.
The seed. A random secret the service generates when you set up two-factor authentication, delivered as a QR code. Both sides keep a copy.
The time. The current time, divided into fixed windows - thirty seconds by convention. Everyone using the same window number gets the same input.
The algorithm. The seed and the window number are combined through a keyed hash, and the result is truncated to six digits.
Because both sides know the seed and both can read a clock, they arrive at the same six digits without ever communicating. That is why an authenticator works with no signal, no data, and no account.
TOTP is defined by RFC 6238, a public standard, which is why a code generated by any compliant authenticator is accepted by any compliant service. A Seedkeeper PRO implements the same standard as a phone app - see Adding a TOTP Account.
Why Clocks Matter
The one operational quirk of TOTP: your device and the server must roughly agree on the time.
If a device's clock drifts by more than a window or two, its codes stop being accepted. Servers usually tolerate a small drift by checking the adjacent windows, but a phone set to the wrong time zone or a device with a dead clock will produce codes that look right and work nowhere.
A Seedkeeper PRO has no battery and no clock of its own. It takes the time from the phone or computer it's connected to at the moment you request a code, which sidesteps drift entirely - one less thing to maintain.
Why the Code Expires
The thirty-second window limits how long a captured code stays useful. Someone reading it over your shoulder, or intercepting it in transit, has a very short opportunity.
It is a genuine improvement, and it is also the reason TOTP is not phishing-resistant: thirty seconds is an eternity for an automated relay. A fake page collecting your code and forwarding it to the real service does so in under a second - see Passkey vs OTP.
What TOTP Protects Against, and What It Doesn't
Protects against: leaked password databases, credential stuffing, password reuse, brute force, and anyone who obtains your password without also holding your device. That covers the large majority of real account takeovers.
Does not protect against: real-time phishing, a breached service leaking the seed itself, or malware on the phone holding your seeds.
Strengthening the Weak Points
Two practical measures address most of the residual risk.
Keep the seed off a general-purpose device. In an authenticator app, the seed sits in app storage on a phone that also browses the web. On a Seedkeeper PRO, it is written into the secure element and can never be read back out.
Add an access PIN. By default anyone who scans the device can see the codes. Setting an OTP access PIN closes that gap - see Setting Up an OTP Access PIN.
Everything on one device
Seedkeeper PRO stores your passwords, your TOTP codes and your passkeys on a single EAL6+ secure element, FIDO2 Level 1 certified. No cloud, no account, no vendor lock-in.
Get your Seedkeeper
FAQ
What does TOTP stand for?
Time-based One-Time Password. It is an open standard defined by RFC 6238, which is why any compliant authenticator works with any compliant service.
Why does my TOTP code change every 30 seconds?
Because the code is computed from the current time divided into thirty-second windows. When the window advances, the input changes and so does the code, whether or not the previous one was used.
Why is my TOTP code rejected?
Usually a clock problem: if your device's time drifts too far from the server's, the codes no longer match. Check the device's time settings, and make sure you enter the code before the window closes.
Does TOTP need an internet connection?
No. Both your device and the service compute the code independently from a shared secret and the current time, so nothing is transmitted during generation.
Is TOTP safer than SMS codes?
Yes, clearly. SMS depends on your phone number, which can be transferred to an attacker through SIM swapping. A TOTP seed is held on your device and is not exposed to that attack at all.