How two-factor codes work
The six digits in your authenticator are not sent to your phone. They are calculated on it, from a secret and the time, exactly as the service calculates them on its side.
A shared secret
When you turn on two-factor authentication, the service creates a random secret key and shows it to you as a QR code. Scanning it copies the key into your authenticator. From then on, two copies exist: one held by the service, one on your phone.
The QR code holds a link that starts with otpauth://. Besides the key, it carries the name of the service and of your account, and sometimes the settings to use. It is a standard, which is why any authenticator can read the QR code of any service.
Codes that follow the clock: TOTP
Most services use TOTP, time-based one-time passwords, defined in RFC 6238. Every thirty seconds, the app and the service each take the current time, combine it with the key through a cryptographic function called HMAC, and reduce the result to six digits. Same key, same time, same code.
This is why your codes work in airplane mode, and why a phone clock that is more than about thirty seconds out produces codes the service refuses. If your codes are rejected, check that the date and time are set automatically.
Codes that count: HOTP
HOTP, defined in RFC 4226, replaces the time with a counter that goes up by one each time you ask for a code. It is rarer, and turns up with some banks and hardware tokens. Otter supports both.
What this means for your security
- A code is useless after thirty seconds, so someone who reads one over your shoulder cannot use it later.
- The key is what matters. Whoever has it can make your codes for ever, which is why Otter encrypts it and never shows it again once it is added.
- A code does not protect you from a fake sign-in page: typed there, it can be used by the attacker straight away. Check the address before you type.
- Losing the key means losing the codes, which is why a backup matters.
See it for yourself
The Otter home page has a live demonstration: scan its QR code with any authenticator, and the code on your phone matches the one on the page, changing at the same moment.
Try Otter
Free on iPhone and Android. No account to create and nothing to sync: install it, scan your first QR code, and the code is on your screen.