- Home
- Technology
- Passwords and encryption
- Two-factor codes
Two-factor codes
How app codes add a second lock, and how time-based codes work.
The short version
Two-factor sign-in asks for something you know, your password, and something you have, usually your phone. A stolen password alone is not enough. Time-based app codes work because the app and site share a secret and use the same time window to calculate a code. It builds on passwords and encryption.
I always thought the code was sent to my phone by the website each time.
An app code is not sent at all.
Both sides work it out independently.
Know and have
Security people talk about three kinds of proof: something you know, such as a password; something you have, such as a phone or key; and something you are, such as a fingerprint. Using two different kinds means a thief needs both.
Where the codes come from
Text-message codes are sent by the site and arrive by SMS. They are better than nothing but can be intercepted, for example if someone talks a phone company into moving your number.
Time-based authenticator apps use a secret shared during setup, often shown as a QR code. A common standard produces a six-digit code that changes every 30 seconds; other authenticator methods and settings can differ. The site uses the same secret and an accepted time window to check the code you enter. The code itself is generated on your device.
Two-factor makes an account impossible to break into.
It makes it much harder, but a convincing fake website can ask you for the code and pass it on at once. Always check that you are on the real address first.
Source: NIST Digital Identity Guidelines explains one-time codes and their limits against phishing.
Key takeaways
- It combines something you know and something you have.
- Time-based app codes are generated from a shared secret and the time.
- Nothing is sent for an app code.
- A fake site can relay a one-time code; passkeys and other cryptographic sign-in methods can resist this kind of phishing.
Now you know.
You need two proofs.
The code is made from a secret and the time.
Fake sites can still ask.
Last reviewed 3 Nov 2026
