Why do the 6 digits in Google Authenticator match? A diagrammed guide to TOTP and shared secrets

About this article
This article was created using an automated generation workflow powered by generative AI. Official specifications from NIST, Google, Microsoft, RFC, and others were verified on November 6, 2026, and explained starting from common user questions.

Verification Status: 📘 Official specifications verified / Real account registration, login, and WordPress display not performed

The original diagram above is a conceptual diagram for understanding the mechanism. It does not reproduce actual screens or confidential information, allowing readers to arrive at the same conclusion using only the Mermaid diagrams and explanations in the text.

"Why do the numbers in the authenticator app keep changing even while on an airplane?" When a 6-digit verification code is displayed even when no network signal reaches the smartphone, it feels mysterious what the app is actually doing. A typical method used in Google Authenticator and other apps is a time-based one-time password called TOTP (Time-Based One-Time Password).

TOTP does not receive a code from the server every time. The smartphone side and the login service side hold the same secret information at the time of registration, and each calculates a value derived from the current time. They confirm that these two calculation results match. What is used here isshared secret information, which is a different mechanism from passkey public key cryptography.

Why the initial QR code is important

When registering an authenticator app, the service may display a QR code. In standard TOTP, the QR code contains registration information such as the secret information, the account identifier, the number of digits in the code, and the calculation method. Not all services use the exact same content. The authenticator app that scans the QR code registers that information to use for the next login.

This QR code is not just an image for explanation purposes. If you show a genuine registration QR code to someone else, there is a risk that person can register the same secret information. Just as you would not send your password to others, the TOTP shared secret must also be protected. This article does not include real QR codes, secrets, or actual 6-digit codes. Even when sharing screenshots of company setting screens, be careful not to let the registration QR code appear.

After registration, the reason the service prompts you to enter the verification code displayed in the app is to check whether both parties are able to use the same secret. However, just because registration is complete does not mean you can always recover your account if you lose your smartphone. Registering an authentication method and preparing recovery means should be considered as separate tasks.

Diagram: Performing the same calculation in two places

sequenceDiagram
    participant U as 利用者
    participant S as ログインサービス
    participant A as スマホの認証アプリ
    S-->>U: 登録用のQRを表示
    U->>A: QRを読み取って登録
    Note over S,A: 同じ共有秘密を持つ
    A->>A: 秘密と現在時刻からコードを計算
    A-->>U: 数字を画面に表示
    U->>S: 数字を入力
    S->>S: 秘密と時刻から期待値を計算
    S-->>U: 一致と利用条件を確認

What we want to focus on in this diagram is that communication between the smartphone and the service is not depicted when the code is displayed. This is because calculations can be performed in respective locations as long as the time and secret are known. While communication with the server is required when entering the code, an internet connection is not necessarily required just to display the numbers themselves on the screen.

Why do the numbers change at regular intervals?

RFC 6238, which defines the TOTP standard, outlines a method of dividing time into fixed intervals to use as input for calculations. A typical time step is 30 seconds. However, the number of digits, time step, and algorithm actually adopted by a given service depend on its configuration. You cannot assume that "any authenticator app always uses 6 digits and 30 seconds."

The calculation utilizes a message authentication mechanism using a secret key called HMAC. TOTP is built on a method called HOTP, and it can be understood as using a value derived from the current time instead of the counter used by HOTP. Short numbers that are easy to input are obtained by converting the original calculation results according to certain rules. Because the numbers are short, the server side must properly limit the number of attempts and avoid repeating input failures many times.

For those who want to know moreRFC 6238Algorithm Requirements are useful. It explains that the same time interval as the shared secret is required. To learn more about the underlying mechanism, readingRFC 4226allows you to verify the connection from HOTP, which uses HMAC, to TOTP.

If you change one condition: Smartphone time drifts

If the smartphone's clock drifts significantly from the correct time, the interval calculated by the app and the interval on the server side may no longer match. While services may allow for slight time differences, the allowable number of seconds is not uniform. If a code is displayed as incorrect, you should safely isolate the issue rather than immediately making major changes to your smartphone settings.

First, verify that you have correctly selected the registered service and account combination. Next, check whether it is immediately after the code has rotated or if the validity period has expired. Then, check whether automatic time synchronization is enabled in the device's OS. Checking in the correct order helps reduce damage compared to repeatedly entering codes and getting locked out.

flowchart TD
    A["コードが受け付けられない"] --> B{"正しいサービス名か"}
    B -->|"いいえ"| C["登録名を確認する"]
    B -->|"はい"| D{"有効時間内か"}
    D -->|"いいえ"| E["次のコードで試す"]
    D -->|"はい"| F["OSの時刻同期を確認"]
    F --> G{"解消しないか"}
    G -->|"はい"| H["サービスの公式復旧手順へ"]
    G -->|"いいえ"| I["通常のログインへ"]

The diagram shows the order of checks and does not override attempt limits or corporate account protection policies. In environments where you need to contact an administrator, prioritize those procedures. Experimenting with the behavior of production services by intentionally misaligning the device clock is not recommended.

Can Google Authenticator be transferred to a new device?

Google Authenticator includes a feature to sync codes to a Google Account, and there is also a method to use it without syncing. The procedure for changing devices depends on whether you use syncing. Considering that the sync account might become inaccessible or the device might be lost, you should check the recovery method for each service.

Google Official Helpexplains that codes can be generated offline, describes syncing, manual transfer, handling loss, and how to verify if the time is correct. Older procedures found via search may feature menu names that differ from the current app. Use official documentation as the basis to verify what current versions can do.

For services that allow issuing backup codes, store them securely and separately from the authenticator app. Recovery codes are not ordinary notes; they are confidential information that can be used for identity verification. If you suspect that a secret QR code or registration key has leaked externally, you may need to invalidate that registration and re-register using the official procedure.

Limitations of 6-Digit Codes Against Phishing

Although verification codes change in a short time, this does not eliminate attacks that trick users into entering them on a fake site on the spot. An attacker may request the code during the login process and relay it to the legitimate service. The single-use nature of TOTP and the technical association of whom a code may be given to are different concepts.

NIST'sSP 800-63Bdoes not treat manually entered OTPs as a phishing-resistant method. This does not mean you should hastily abandon TOTP. It implies that while it enhances security beyond passwords alone, it requires comparison with other methods, such as passkeys, depending on the importance.

Operations for Business Use

When using TOTP in an enterprise, you must determine who authorizes app registration and re-registration, how to verify identity when replacing devices, and how to invalidate old registrations. The help desk must not easily request secret backups kept by the user or share QR codes via email. Both daily convenience and incident response must be designed.

Furthermore, monitoring should not simply assume that consecutive login failures are caused by user input error; instead, check device time, registered services, occurrence time of attempts, and user reports. It is also important not to record raw codes in logs that are unnecessary for investigation and not to distribute personal information indiscriminately.

Misconceptions to Verify

It is incorrect to think that "because codes are displayed, a server's public key is used." TOTP is a method that uses a shared secret. Nor is the secret itself a 6-digit number "because the numbers are 6 digits." The shared secret at registration is different information. The notion that "you cannot use it without internet access on your smartphone" is also generally incorrect. Code generation itself can be done offline. However, communication with the sign-in destination, syncing, and transfer involve internet connectivity.

Generating the Same 6-Digit Code Does Not Mean You Should Reveal the Shared Secret

Even though the displayed numbers are 6 digits, the underlying shared secret is not literally a 6-digit number. It uses a long-held secret and the current time to convert it into a short, easy-to-enter number. Since services that allow unlimited attempts with short numbers are dangerous, the server side must properly manage attempt limits, expiration times, and reuse. Behind the code input field seen by the user, there are multiple layers of defense.

If two authenticator apps share the same time, secret, and calculation conditions, they may display the exact same verification code. The two smartphones are not communicating with each other. While this is a useful property for correct migration, the same state can occur if someone else duplicates your registration QR code. This is why registration QR codes should be treated with as much caution as passwords.

Sequence to Check Before Changing Devices

Before resetting your old smartphone, verify that you can log in to each service on the new device and that you can recover access using backup codes or alternative methods. Google Authenticator offers syncing and manual transfer methods, but circumstances vary by service. The presence of syncing does not guarantee the migration of all registered destinations. Until verification on the new device is complete, it is safer not to hastily erase information from the old device.

When you lose your smartphone, the issue is how to verify your identity without the code at hand. Check the official recovery procedure of the service you are using, and for enterprise accounts, follow the administrator's re-registration procedure. Fake support may exploit your urgency to recover the account by asking for backup codes. Before handing over any secret values to others, verify whether the contact channel is legitimate.

Difference from SMS numbers

The verification code received via SMS is also a temporary number, but its generation and delivery method differ from TOTP. Since TOTP is calculated by the authenticator app based on a shared secret and time, a mobile network connection is not strictly required just to display the number. SMS typically relies on the service delivering the generated content via a telecommunications network, which requires the device to be able to receive signals. It is important not to assume they use the same technology just because they look like numbers.

On the other hand, users can still be tricked into submitting numbers into a fake site's input field for either method. Just because authenticator apps have advantages over SMS does not mean they automatically include mechanisms to prevent phishing. Verify the authenticity of the service you are accessing, and for critical use cases, compare it with methods like passkeys.

No need to ask for codes at the help desk

When a user reports that a code is not working, avoid operational practices where they send the actual 6-digit code or registration QR code via chat. Troubleshooting can often be done using non-secret information, such as the service name, account selection, whether a device change occurred, OS time settings, or the screen where it got stuck. If necessary, proceed with re-registration after completing the prescribed identity verification.

RFC 6238 defines how to calculate the code, but it is not a document that specifies Google Authenticator menu names or synchronization operations. The calculation mechanism is described inRFC 6238and device migration or settings are described inGoogle's official help documentation, which helps avoid confusing standards with product guidelines. Learning the technology also leads to providing support without unnecessarily collecting secrets.

Summary

The numbers in an authenticator app are the result of calculations using a shared secret and time. The reasons why a registration QR code becomes sensitive information, why numbers can be generated without cellular reception, and why time drift easily causes failures can all be explained by a single mechanism. The most important things are protecting the shared secret rather than memorizing the 6 digits, verifying the correct login destination, and securing recovery options for emergencies.

Which official documentation should you read?

• RFC 6238: Check the standard handling of TOTP time, shared secrets, and 30-second intervals.RFC 6238

• RFC 4226: Confirm that HOTP and HMAC form the foundation of TOTP calculations.RFC 4226

• Google Authenticator official help: Check information on code display, synchronization, device migration, and handling time discrepancies.Google Authenticator official help

• NIST SP 800-63B: Verify OTP expiration, replay prevention, and phishing resistance limitations.

Security Technologies and Practical Usage: Series Table of ContentsReturn to.