By the TriPass team · Published 11 October 2026 · General security information, not a guarantee about any product.
An authenticator app shows a 6-digit code that changes every 30 seconds. It is calculated from a secret key you scan once (usually as a QR code) and the current time, using an open standard called TOTP (RFC 6238). The website does the same calculation, so a matching code proves you have the device holding the secret: a second factor on top of your password.
What is two-factor authentication?
Two-factor authentication (2FA) asks for two different kinds of proof when you sign in: something you know (your password) and something you have (your phone, a security key) or something you are (a fingerprint or face). Someone who steals or guesses your password still can’t get in without the second factor.
The most common second factors are a code sent by text message (SMS), a code from an authenticator app, a push prompt from the service’s own app, and a security key or passkey.
How authenticator app codes are made (TOTP)
Authenticator apps use an open standard called TOTP, Time-based One-Time Password, published as RFC 6238. It builds on an earlier standard, HOTP (RFC 4226). Step by step:
- Setup. The website creates a random secret key and shows it to you once, usually as a QR code. The QR code holds an
otpauth://link with the secret written in Base32. Your app saves the secret; the website keeps its own copy. - Time step. Both sides take the current time in seconds since 1 January 1970 and divide by 30, ignoring the remainder. That number changes every 30 seconds.
- Hash. Both compute an HMAC (by default HMAC-SHA-1) of the time step, keyed with the secret.
- Shorten. A standard step called dynamic truncation turns the 20-byte result into a number, and the last 6 digits become the code.
- Compare. When you type the code, the website does the same calculation. Most services also accept the code from one step either side, to allow for clocks being slightly out.
No network connection is involved after setup: the code comes only from the secret and the clock, which is why authenticator apps work in flight mode. Here is the calculation running live:
This is a made-up demo secret. Don’t paste a real one into any web page you don’t need to, even though this one sends nothing.
Authenticator app vs SMS vs passkeys
| Method | Main strength | Main weakness |
|---|---|---|
| SMS codes | Works on any phone, nothing to install | Codes can be intercepted, for example after a SIM swap moves your number to an attacker’s SIM |
| Authenticator app (TOTP) | Works offline; the secret never travels after setup | A convincing fake sign-in page can ask for the code and use it within its 30 seconds |
| Security key or passkey (FIDO/WebAuthn) | Phishing-resistant: it won’t sign in to the wrong website | Not every service supports it yet; you need a backup key or method |
CISA, the US Cybersecurity and Infrastructure Security Agency, calls phishing-resistant MFA the standard to aim for and names FIDO/WebAuthn as the only widely available form of it. For most people, the practical order is: a passkey or security key where a service offers one, an authenticator app everywhere else, and SMS only when nothing better is available. Any of them is far better than a password alone.
How to set up an authenticator app
- In the account’s security settings, choose two-factor authentication and the “authenticator app” option.
- Scan the QR code with your authenticator app, or type in the setup key if you can’t scan.
- Enter the 6-digit code the app shows, to prove the setup worked.
- Save the backup (recovery) codes the site gives you, somewhere other than the phone. They are your way in if you lose the phone.
- Start with the accounts that unlock everything else: your email, your Apple or Google account, and your bank.
What happens if you lose your phone?
If the secrets only ever lived on that phone, you need each site’s backup codes, or its account-recovery process, to get back in. That is why the backup codes matter. Some authenticator apps can also keep an encrypted copy of your secrets, so a new phone can restore them; check how a given app protects that copy, because anyone who can open it holds your second factor.
Should 2FA codes live in your password manager?
It is a trade-off, and both choices are reasonable:
- Together is more convenient, and your codes are backed up with the rest of your vault. The cost: anyone who opens your vault has both factors for those accounts, so the second factor no longer protects you against someone who learns your master password.
- Separate keeps the factors independent, at the price of a second app and a second backup plan.
A common middle ground is to keep codes for everyday accounts with your passwords, and to use a separate method (ideally a security key or passkey) for the few accounts that would let someone take over the rest, such as your primary email.
Password manager vs authenticator app
A password manager stores and fills in your passwords (the “something you know”). An authenticator app generates the time-based codes (the “something you have”). They solve different problems, which is why many people use both, or one app that does both.
The TriPass authenticator
TriPass for iPhone includes an authenticator. These facts describe the current pre-release build; TriPass is not on the App Store yet.
- Standard TOTP codes, unlimited on the free plan.
- Add codes by scanning a QR code or entering the setup key. Codes can be brought over from Google Authenticator.
- With a TriPass account, codes are encrypted on your iPhone before they sync, and you can also see them in the web vault at tripass.com.au and in the TriPass Chrome extension (in beta). Without an account they stay only on the phone.
- TriPass does not support passkeys or security keys.
See all features, or how the encryption works.